Appraisal of mask manufacture information security based on ISO27001 and common criteria

Information security management has become one of the key areas of organization management and customer audit, also has been concerned by more and more clients and third-part audit organizations. How to establish, implement, maintain and continually improve information security management system has become a big concern for enterprises to improve strategic management level. ISO27001 standards is an evaluation scheme of information security operational system. But ISO27001 is neither necessary nor sufficient to pass Common Criteria evaluation. This paper presents the difference and the relationship between ISO27001 Information Security Management System (IAMS) and Common Criteria which are popular in many semiconductor companies, and will find more benefits in information system management with these two types of certifications for semiconductor production process.