Difference between revisions 601840424 and 603427202 on enwiki

[[File:Risk Management Elements.jpg|thumb|Plan-Do-Check-Act Cycle]]
[[File:Isms framework.jpg|thumb|ENISA: Risk Management and Isms activities]]
An '''information security management system'''<ref>{{cite web|title=Security management system’s usability key to easy adoption|url=http://www.sourcesecurity.com/news/articles/co-4108-ga.8554.html|publisher=sourcesecurity.com|accessdate=22 August 2013}}</ref>  (ISMS) is a set of policies concerned with [[information securi(contracted; show full)isk based information security standard, which means that organizations need to have a risk management process in place. The risk management process fits into the [[PDCA]] model given above.<ref>{{cite journal|last=Humphreys|first=Edward|title=Information security management system standards|journal=Datenschutz und Datensicherheit - DuD|date=8 March 2011|year=2011|volume=35|issue=1|pages=7–11|doi=10.1007/s11623-011-0004-3}}</ref> 

However, the latest standard, [[ISO/IEC 27001:2013]], does not 
use this cycleemphasise the Deming cycle anymore. The ISMS user is free to use any management process (improvement) approach like PDCA or [[Six Sigma]]s [[DMAIC]].

Another competing ISMS is [[Information Security Forum]]'s ''[[Standard of Good Practice]]'' (SOGP). It is more [[best practice]]-based as it comes from ISF's industry experiences.<br />

Some other best-known ISMSs ar⏎
⏎
Some best-known ISMSs for computer security certification are the [[Common Criteria]] (CC) international standard and ITits predecessors [[Information Technology Security Evaluation Criteria]] (ITSEC) and [[Trusted Computer System Evaluation Criteria]] (TCSEC).<ref name="isms">{{cite journal|last=Jo|first=Heasuk|coauthors=Kim, Seungjoo; Won, Dongho|title=Advanced information security management evaluation system|journal=KSII Transactions on Internet and Information Systems|date=1 January 2011|year=2011|volume=5|issue=6|pages=1192–1213|doi=10.3837/tiis.2011.06.006}}</ref><br />

Some nations publish and use their own ISMS standards, e.g., the Department of Defense  (DoD) Information Technology Security Certification and Accreditation Process (DITSCAP) of USA, the [[Department of Defense Information Assurance Certification and Accreditation Process]]  (DIACAP) of USA, [[Trusted Computer System Evaluation Criteria]] (TCSEC) of USA, the German [[IT Bbaseline Pprotection Manual (ITBPM) of Germany]], ISMS of Japan, ISMS of Korea, Information Security Check Service (ISCS) of Korea.<ref name="isms" />

Other frameworks such as [[COBIT]] and [[ITIL]] touch on security issues, but are mainly geared toward creating a governance framework for information and IT more generally. COBIT has a companion framework ''[[Risk IT]]'' dedicated to Information security.<br />

Below table illustrate the certification structure comparison of some best-known ISMSs:<ref name="isms" /><br />
{| class="wikitable"
|-
! !! '''BS 7799''' !! '''Common Criteria(CC)''' !! '''IT Security Evaluation Criteria(ITSEC)'''
|-
| '''Operation Area''' || England || About 25 Countries|| European Countries
|-
| '''Basic Structure''' || - 6 Management phases<br /> - 11 Security domains<br /> - 139 Control objectives<br /> - 133 Security controls  || - 3 Parts<br /> - 11 Security functional requirements<br /> - 8 Assurance requirements || - 4 Phases<br /> - 6 Levels
|-
(contracted; show full)* [[WARP (information security)]]
* [[TRAC (ISMS)]]

== Notes and references ==
<references/>


[[Category:Data security]]