Difference between revisions 597183749 and 599262478 on enwiki

[[File:Risk Management Elements.jpg|thumb|Plan-Do-Check-Act Cycle]]
[[File:Isms framework.jpg|thumb|ENISA: Risk Management and Isms activities]]
An '''information security management system'''<ref>{{cite web|title=Security management system’s usability key to easy adoption|url=http://www.sourcesecurity.com/news/articles/co-4108-ga.8554.html|publisher=sourcesecurity.com|accessdate=22 August 2013}}</ref>  (ISMS) is a set of policies concerned with [[information securi(contracted; show full)izing the impacts of security incidents, ISMS ensures business continuity, customer confidence, protect business investments and opportunities, or reduce damage to the business.<ref>{{cite journal|last=Ma|first=Qingxiong|coauthors=Schmidt, Mark B.; Pearson, Michael|title=An integrated framework for information security management|journal=Review of Business|year=2009|volume=30|issue=1|pages=58-69|url=http://www.stjohns.edu/reviewofbusiness|accessdate=26 October 2013}}</ref> 

Large organizations
 or organizations such as, banks and financial institutes, telecommunication operators, hospital and health institutes and public or governmental bodies have many reasons for addressing information security very seriously. Legal and regulatory requirements which aim at protecting sensitive or personal data as well as general public security requirements impel them to devote the utmost attention and priority to information security risks.<ref name=ENISAFULL/>

Under these circumstances, the development and implementation of a separate and independent management process - namely an Information Security Management System is the one andSMS - is the only alternative.<ref name=ENISAFULL/>

The development of an ISMS framework based on [[ISO/IEC 27001:2005]] entails the following six steps:<ref name=ENISAFULL/>
# Definition of security policy,
# Definition of ISMS scope,
# Risk assessment (as part of risk management),
# Risk management,
# Selection of appropriate [[security control|controls]] and
(contracted; show full)* [[WARP (information security)]]
* [[TRAC (ISMS)]]

== Notes and references ==
<references/>


[[Category:Data security]]