ISO27000认证与ISMS认证区别
ISO27000 certification and ISMS certification difference
ISO27000认证：信息安全最早是由英国贸工部以及BSI（英国标准协会）、KPMG（毕马威国际会计公司）等公司的相关专家共同开发制定的一套信息安全管理体系标准。
ISO27000 certification: information security is the first by the DTI and BSI ( British Association standard ), KPMG ( KPMG ) Company and other related experts to develop a set of information security management system standard.
BS7799-1：1995信息安全管理实施规则，它提供了一套综合的、由信息安全最佳惯例组成的实施规则，其目的是作为确定企业信息系统在大多数情况下，所需控制范围的唯一参考基准，并且适用于大、中、小型组织。
BS7799-1: 1995 code of practice for information security management, it provides a comprehensive set of information security best practices, by composition of the implementation rules, its purpose is identified as the enterprise information system in most of the cases, the required control range only reference, and is suitable for big, in, small organization.
由于该标准采用指导和建议的方式编写，因而不宜作为认证标准使用，1998年为了适用第三方认证的需求，英国又制定了世界上第一个信息安全管理体系认证标准BS7799-2：1998信息安全管理体系规范，它规定信息安全管理体系要求与信息安全控制要求，是一个组织的全面或部分信息安全管理体系评估的基础，它可以作为对一个组织的全面或部分信息安全管理体系进行评审认证的标准。
Since the standard using the guidance and recommendations prepared the way, therefore should not be used as standards for certification, in 1998 in order to apply third party certification requirements, Britain also developed the world's first information safety management system certification standard BS7799-2: 1998 specification for information security management system, it provides information security management system requirements and information security requirements, it is an organization of all or part of information security management system assessment based, it can be used as an organization of all or part of information security management system certification standard.
举例来说，对第一方（供方或卖方）建立的ISMS，第二方（需方或买方）无法判定是否符合标准要求，或第二方对第一方在信息安全管理方面不了解，没有信心，而由第三方来判定和证明。
For example, the first party (supplier or seller) to establish ISMS, second party ( buyer or buyer) to determine whether meet the requirements of the standard, or second party to the first party in the aspect of information security management does not know, lack of confidence, and by the third party to judge and prove.
第三方既要对第一方负责，又要对第二方负责，不偏不倚，出具的证明要能获得双方的信任，这样的活动就叫做“ISMS认证”。
The third party is responsible for both the first party, but also to the second party, avoid leaning to either side, to be able to obtain a certificate issued by the trust of both parties, this activity is called" ISMS certification".