Difference between revisions 728828374 and 728840649 on enwiki

< previous diff
next diff >
Information security management system
[[File:Risk Management Elements.jpg|thumb|Plan-Do-Check-Act Cycle]]
[[File:Isms framework.jpg|thumb|ENISA: Risk Management and Isms activities]]
An '''information security management system'''<ref>{{cite web|title=Security management system’s usability key to easy adoption|url=http://www.sourcesecurity.com/news/articles/co-4108-ga.8554.html|publisher=sourcesecurity.com|accessdate=22 August 2013}}</ref>  (ISMS) is a set of policies concerned with [[information securi(contracted; show full)CMM]], [[ISO/IEC 27001]], and general information governance and security concepts. ISM3 can be used as a template for an ISO&nbsp;9001-compliant ISMS. While [[ISO/IEC 27001]] is controls based, ISM3 is process based and includes process metrics. ISM3 is a standard for security management (how to achieve the organizations mission despite of errors, attacks and accidents with a given budget). The difference between ISM3 and ISO/IEC 21827 is that ISM3 is focused on management, ISO 21287 on Engineering.


<ref></ref>== Need for an ISMS ==
Security experts say:<ref name=ENISAFULL>[http://www.enisa.europa.eu/act/rm/cr/risk-management-inventory/files/deliverables/risk-management-principles-and-inventories-for-risk-management-risk-assessment-methods-and-tools/at_download/fullReport Enisa Risk management, Risk assessment inventory, page 8]</ref>
(contracted; show full)* [[Vulnerability (computing)]]
* [[WARP (information security)]]

== Notes and references ==
<references/>

{{Authority control}}
[[Category:Data security]]