David Brewer

Dr David Brewer was one of the first consultants to advise the British Government on information security matters, helping to establish the first ever computer security evaluation facilities and evaluation criteria.

He was a founder member of the Department of Trade and Industry’s Commercial Computer Security Centre (1987-1992) and became co-author of the European IT Security Evaluation Criteria (the forerunner of ISO/IEC 15408) and its associated evaluation manual. He was co-author of the original ISMS standard, BS 7799 Part 2, and Head of the UK delegation to ISO JTC 1 SC27 WG1, which is responsible for the ISO 27000 family of standards. Recently he was the editor for the revision of ISO/IEC 27004 (Monitoring, measurement, analysis, and evaluation) and a co-author of BS 7799-3:2017 (Guidelines for information security risk management (revision of BS ISO/IEC 27005:2011)).

David has conducted a wide variety of consultancy assignments in information security spanning 38 years in over 23 countries. He has assisted UK government and commercial organisations in their acquisition of major IT systems and with Visa and GlobalPlatform on the security of dynamically reconfigurable smart cards. He is well known for his work in rolling out ISO/IEC 27001 to the whole of the Civil Service in Mauritius (an exemplar of his ISMS implementation methodology), and a number of high profile ISMS projects in the Middle East.

His seminal research papers include: The Chinese Wall Security Policy, published in 1989; and Measuring the Effectiveness of an Internal Control System, published in 2004. He is the author of several books on ISO/IEC 27001.