Publishing and copyright information

The BSI copyright notice displayed in this document indicates when the document was last issued.

No copying without BSI permission as permitted by copyright law.

Publication history

First published May 2013

Foreword

This PAS was sponsored by the Cyber Alliance (comprising Cisco, Control Risks, G4S, PA Consulting Group and Symantec). Its development was facilitated by BSI Standards Limited and is published under licence from The British Standards Institution. It came into effect on 31 May 2013.

Acknowledgement is given to the technical author Grace Shacklady (of G4S) and to the following organizations involved in the development of this specification as members of the steering group:

3SDL
Association of British Certification Bodies
Bird & Bird
BP plc
Control Risks
Department for Business, Innovation and Skills
G4S
King’s College London
Information Security Forum
Intellect
Leading Edge Forum
Mike StJohn Green Consulting Ltd
PA Consulting Group
Roke Manor Research
The Security Institute

Acknowledgement is also given to those individuals and organizations that submitted comments during the public consultation.

The British Standards Institution retains ownership and copyright of this PAS. BSI Standards Limited as the publisher of the PAS reserves the right to withdraw or amend this PAS on receipt of authoritative advice that it is appropriate to do so. This PAS will be reviewed at intervals not exceeding two years, and any amendments arising from the review will be published as an amended PAS and publicized in Update Standards.

Relationships with other publications

This PAS is intended to be used as a stand-alone specification, or it can be used as a companion to other relevant standards, by any organization that wishes to have confidence in its cyber security.

The requirements of this PAS define the overall outcomes of effective cyber security. These outcomes can be achieved in a variety of ways, which are not specified here. However Annex A provides an illustration of how other relevant standards can deliver the requirements of this PAS. It should be noted, however, that the list in Annex A is not exhaustive or prescriptive and there may be other standards which are more specific to an organization’s business.

The PAS specifically targets top management of an organization and intentionally has broad coverage in terms of its requirements. It does not intend to replace existing, well-established standards but provides a potential framework for understanding the outcomes of other standards in a specific cyber security context.

Use of this document

As a specification document, this PAS provides a set of absolute requirements (also referred to as outcomes), each objectively verifiable; none of the requirements is optional.

There is no implied implementation order within this PAS. Organizations can choose how they address each clause according to their business scope, assessed risk and risk appetite.

Presentational conventions

The provisions of this standard are presented in roman (i.e. upright) type. Its requirements are expressed in sentences in which the principal auxiliary verb is “shall”.

Commentary, explanation and general informative material is presented in smaller italic type, and does not constitute a normative element. For some clauses, introductory text is provided in a shaded box to provide additional context and information about that clause.

The word “should” is used to express recommendations, the word “may” is used to express permissibility and the word “can” is used to express possibility, e.g. a consequence of an action or event.

Spelling conforms to The Shorter Oxford English Dictionary.

Contractual and legal considerations

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a PAS cannot confer immunity from legal obligations.

Executive summary

Overview

Benefits

Outcomes of PAS 555

0 Introduction

0.1 Cyber security

Cyber security is a term that encompasses and extends information assurance and information technology (IT) security, both of which have been developing as concepts over the last 40 years, ever since the first computer virus was described in 1972. Almost every organization relies on cyberspace, with most business assets linked to it in some way. It is not only IT assets that have network connectivity, for example photocopiers, telephone systems, building control systems, industrial process control and manufacturing plants are now vulnerable to remote attack.

The business assets that are now exposed range from corporate data to customer data, intellectual property, and even the brand and reputation of an organization. Therefore, threats to cyber security present a critical challenge to organizations in terms of scale, complexity and potential impact.

0.2 Risk and resilience

PAS 555 sets out to define good cyber security in the context of risk, where the risk is managed and addressed commensurate with an organization’s business scope, assessed risk and risk appetite. Its use will support an organization to prepare itself in order to optimize its defence against, response to and recovery from any cyber security incident.

0.3 An outcome-based standard

Many cyber security standards and guidelines are available. They tend to define good practice as to howelements of effective cyber security might be achieved. For example, BS ISO/IEC 27001, or guidelines such as the Critical controls for effective cyber defense [1], the 10 Steps to cyber security: Executive companion [2] and ISF’s Standard of Good Practice [3]. However, the challenge presented by rapid changes in technology and how cyberspace is exploited means that the way in which any particular security objective is achieved will also need to adapt rapidly.

PAS 555 instead defines the fundamental set of outcomes that these controls, systems and processes aim to achieve. As a result, they are less likely to change over time whereas the way in which the outcomes are achieved can change and develop. This specification also applies to the whole enterprise and its supply chain, avoiding the dangers that can arise when the scope of security measures covers only part of the business.

While a freedom of choice in the how is provided, this does not mean that there is an option to be less than robust in the interpretation and application of PAS 555; the outcomes can only be achieved through good practice. Nonetheless, what is appropriate good practice for a large organization may be inappropriate for a smaller one. Scenarios that illustrate how different types of organization can deal with cyber security risk using PAS 555 are given in Annex B.

0.4 Convergence

PAS 555 is not a simple cycle of events, more a mesh of interdependent activities; so that an organization’s cyber security integrates physical, IT/technical and intelligence, detection and investigation and learning elements from across the organization.

0.5 Claims of compliance

A claim of compliance can be made on the basis of:

a first-party compliance assessment performed by the organization (self-assessment);
a second-party compliance assessment performed by, for example, a relevant trade association; or
a third-party compliance assessment performed by an organization, such as a certification body, that is independent of both the organization responsible and, for example, a relevant trade association.
NOTE An organization can claim direct compliance with PAS 555 (i.e. when it is used alone and not alongside other standards), or compliance by using it in conjunction with an existing management system standard where an existing management system standard can help an organization comply with some of the requirements of PAS 555 (see Annex A for an illustration of how a selection of other standards can deliver the outcomes of this PAS).

1 Scope

This PAS specifies a framework for the governance and management of cyber security risk.

The requirements of this PAS define the overall outcomes of effective cyber security, and include technical, physical, cultural and behavioural measures alongside effective leadership and governance.

While there are many standards and guidelines available that can help tackle cyber security risk, they tend to define good practice as to how elements of effective cyber security might be achieved. PAS 555 does not specify such processes or actions – it allows any organization to choose how it achieves the specified outcomes, whether that be through the adoption of other standards and management systems, such as BS ISO/IEC 27001, or through its own defined processes.

Since the PAS 555 framework defines the outcomes of effective cyber security, it is less likely to change over time whereas the way in which the outcomes are achieved can change.

The PAS is intended for any organization that wishes to establish confidence in its cyber security governance and management. It is applicable to all organizations regardless of their size, type and the nature of their business.

2 Terms and definitions

3 Management structure

4 Commitment to a cyber security culture

5 Security context

6 Business architecture strategy

7 Capability development strategy

8 Supplier and partner strategy

9 Technology strategy

10 Business resilience

11 Compliance with legislation and other standards

12 Risk assessment

12.1 General

12.2 Asset management

12.3 Threat assessment

12.4 Vulnerability assessment

13 Protection and mitigation

13.1 People security

13.2 Physical security

13.3 Technical security

13.4 Resilience preparedness

14 Detection and response

14.1 External awareness

14.2 Internal monitoring

14.3 Protective monitoring

14.4 Cyber security incident management

15 Recovery

15.1 Investigation

15.2 Data integrity reassurance

15.3 Business-as-usual restoration

15.4 Legal process

16 Compliance analysis and continual improvement

Bibliography

PAS 555:2013

Cyber security risk. Governance and management. Specification

Published:

31 May 2013

Withdrawn:

3 Jun 2025