Difference between revisions 621168248 and 623510641 on enwiki

[[File:Risk Management Elements.jpg|thumb|Plan-Do-Check-Act Cycle]]
[[File:Isms framework.jpg|thumb|ENISA: Risk Management and Isms activities]]
An '''information security management system'''<ref>{{cite web|title=Security management system’s usability key to easy adoption|url=http://www.sourcesecurity.com/news/articles/co-4108-ga.8554.html|publisher=sourcesecurity.com|accessdate=22 August 2013}}</ref>  (ISMS) is a set of policies concerned with [[information securi(contracted; show full)

[[ISO/IEC 27001:2005]] is a risk based information security standard, which means that organizations need to have a risk management process in place. The risk management process fits into the [[PDCA]] model given above.<ref>{{cite journal|last=Humphreys|first=Edward|title=Information security management system standards|journal=Datenschutz und Datensicherheit - DuD|date=8 March 
2011|year=2011|volume=35|issue=1|pages=7–11|doi=10.1007/s11623-011-0004-3}}</ref>  

However, the latest standard, [[ISO/IEC 27001:2013]], does not emphasise the Deming cycle anymore. The ISMS user is free to use any management process (improvement) approach like PDCA or [[Six Sigma]]s [[DMAIC]].

Another competing ISMS is [[Information Security Forum]]'s ''[[Standard of Good Practice]]'' (SOGP). It is more [[best practice]]-based as it comes from ISF's industry experiences.

Some best-known ISMSs for computer security certification are the [[Common Criteria]] (CC) international standard and its predecessors [[Information Technology Security Evaluation Criteria]] (ITSEC) and [[Trusted Computer System Evaluation Criteria]] (TCSEC).<ref name="isms">{{cite journal|last=Jo|first=Heasuk|author2=Kim, Seungjoo |author3=Won, Dongho |title=Advanced information security management evaluation system|journal=KSII Transactions on Internet and Information Systems|date=1 January 2011|year=2011|volume=5|issue=6|pages=1192–1213|doi=10.3837/tiis.2011.06.006}}</ref>

Some nations publish and use their own ISMS standards, e.g. the Department of Defense (DoD) Information Technology Security Certification and Accreditation Process (DITSCAP) of USA, the [[Department of Defense Information Assurance Certification and Accreditation Process]] (DIACAP) of USA, the German [[IT baseline protection]], ISMS of Japan, ISMS of Korea, Information Security Check Service (ISCS) of Korea.<ref name="(contracted; show full)rvation of data confidentiality and integrity etc.).<ref name=ENISAFULL/> By preventing and minimizing the impacts of security incidents, ISMS ensures business continuity, customer confidence, protect business investments and opportunities, or reduce damage to the business.<ref>{{cite journal|last=Ma|first=Qingxiong|author2=Schmidt, Mark B. |author3=Pearson, Michael |title=An integrated framework for information security management|journal=Review of Business|year=2009|volume=30|issue=1|pages=58
-–69|url=http://www.stjohns.edu/reviewofbusiness|accessdate=26 October 2013}}</ref>  

Large organizations, banks and financial institutes, telecommunication operators, hospital and health institutes and public or governmental bodies have many reasons for addressing information security very seriously. Legal and regulatory requirements which aim at protecting sensitive or personal data as well as general public security requirements impel them to devote the utmost attention and priority to information security risks.<ref name=ENISAFULL/>

(contracted; show full)
* be a never ending process;

== Dynamic issues in ISMS ==
There are three main problems which lead to uncertainty in information security management systems (ISMS):<ref name= dynamic>{{cite journal|last=Abbas|first=Haider|author2=Magnusson, Christer |author3=Yngstrom, Louise |author4= Hemani, Ahmed |title=Addressing dynamic issues in information security management|journal=Information Management & Computer Security|date=1 January 
2011|year=2011|volume=19|issue=1|pages=5–24|doi=10.1108/09685221111115836|accessdate=26 October 2013}}</ref> 
* '''Dynamically changing security requirements of an organization'''
(contracted; show full)* [[Vulnerability (computing)]]
* [[WARP (information security)]]
* [[TRAC (ISMS)]]

== Notes and references ==
<references/>


⏎
⏎
[[Category:Data security]]