Information Security Management Systems - A Maturity Model based on ISO/IEC 27001

Julho 2018

An Information Security Management System, according with the ISO/IEC 27001 is the set of “that part of the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security”. ISO/IEC 27001 defines the requirements and process for implementing an Information Security Management System. However, implementing this standard without a detailed plan can become a burden on organizations. This paper presents a maturity model for the planning, implementation, monitoring and improvement of an Information Security Management System based on ISO/IEC 27001. The purpose of this model is to provide an assessment tool for organizations to use in order to get their current Information Security Management System maturity level. The results can then be used to create an improvement plan which will guide organizations to reach their target maturity level. This maturity model allows organizations to assess their current state of affairs according to the best practices defined in ISO/IEC 27001. The maturity model proposed in this paper is evaluated through a multi-step perspective that is used to confirm that the maturity model makes a useful and novel contribution to the Information Security Management domain by taking in consideration the best practice of the domain.

Autores da comunidade :

• 

  D

  Diogo Alexandre Breites de Campos Proença

  ist174723

• 

  J

  José Luís Brinquete Borbinha

  ist13085

  Afiliações e fontes

  IST > INESC-ID

  Instituto de Engenharia de Sistemas e Computadores: Investigação e Desenvolvimento em Lisboa

  IST > DEI

  Departamento de Engenharia Informática

computer-and-information-sciences - Ciências da Computação e da Informação

eng - Inglês