SUMMARY This paper describes a first‐hand experience in Software Process Improvement within a Spanish Company which, since 2002, has been involved in an improvement programme led by our research group. We discuss the experience and the results of this improvement programme, as well as the lessons learned to deal with new future improvement initiatives in other companies of our environment. Copyright © 2010 John Wiley & Sons, Ltd.

In software development companies, as well as in any company, information must be adequately protected. Therefore, the implementation of information security standards has also become crucial in software organizations. Software companies involved in a process improvement initiative according to the ISO/IEC 15504 standard for process assessment and improvement are showing an increasing interest in the implementation of the ISO/IEC 27000 standard for information security management. With the intention of supporting these companies in the implementation of the ISO/IEC 27000 standard, our main goal is the development of a method which provides guidance on the application of both frameworks. As a first step of this work, in this article a mapping between ISO/IEC 27002 and ISO/IEC 15504-5 is presented.