Specifies the requirements for establishing, implementing and documenting information security management systems (ISMSs) and the requirements for security controls to be implemented according to the needs of individual organizations. This Standard is identical to BS 7799.2:1999.