Conference
Information Security Management Systems - A Maturity Model based on ISO/IEC 27001
— 2018
Key information
Authors:
Published in
July 2018
Abstract
An Information Security Management System, according with the ISO/IEC 27001 is the set of “that part of the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security”. ISO/IEC 27001 defines the requirements and process for implementing an Information Security Management System. However, implementing this standard without a detailed plan can become a burden on organizations. This paper presents a maturity model for the planning, implementation, monitoring and improvement of an Information Security Management System based on ISO/IEC 27001. The purpose of this model is to provide an assessment tool for organizations to use in order to get their current Information Security Management System maturity level. The results can then be used to create an improvement plan which will guide organizations to reach their target maturity level. This maturity model allows organizations to assess their current state of affairs according to the best practices defined in ISO/IEC 27001. The maturity model proposed in this paper is evaluated through a multi-step perspective that is used to confirm that the maturity model makes a useful and novel contribution to the Information Security Management domain by taking in consideration the best practice of the domain.
Publication details
Authors in the community:
José Luís Brinquete Borbinha
ist13085
Fields of Science and Technology (FOS)
computer-and-information-sciences - Computer and information sciences
Publication language (ISO code)
eng - English
Rights type:
Only metadata available