The security of a company's information system (IS) is an important requirement for the pursuit of its business. Risk management contributes to the protection of the IS assets. It saves the organism from the losses caused by the emergence of unwanted events having an incidence on the IS objectives and consequently on its strategy. It has also an important role in the decision making about entering new opportunities. In addition, it promises an optimal allocation of information system resources. The risk management process aims to analyze what can happen and what are the eventual consequences for the organization before deciding what needs to be done and reducing the risks to an acceptable level. This paper presents a literature review of IS risk management and gives a comparative analyse of its processes, methods and standards.

KEY-WORDSInformation system, Risk, Risk management, Model of maturity, Life cycle.

The information systems (IS) are a key asset for organizations. Therefore, managing IS risks becomes more and more important especially within a world in perpetual change. Since IS risk management creates added-value, it must follow a process of continuous improvement orchestrated by a maturity model that figures out available pathways for a better improvement. The studied literature shows the lack of an IS risk management maturity model that considers all IS components and specificities of risk management activity. The present article shows first this lack in the section related to the comparative analysis of the existing models. Then, it proposes a maturity model to address this issue. The proposed model aims to assess the information system risk management activity while considering the dependencies between its elements.

No abstract

This paper is a continuation of our first paper dedicated to the presentation of the maturity model for information system (IS) risk management (RM). Its objective is to place the model proposed in the first paper on a case study by the assessment of the maturity of risk management for an IS-CRM (IS dedicated to customer relationship management (CRM)). The sequence of the model requires prior definition of an evaluation system incorporating the setting, the measurement and consolidation methods. In our case study we have gone through four steps: definition of studied components, evaluation of control objectives, calculate the maturity levels for each activity of the RM process and calculate the RM process maturity.