A process framework for information security management

Abstract

Securing sensitive organizational data has become increasingly vital to organizations. An Information Security Management System (ISMS) is a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization's information security. Key elements of the operation of an ISMS are ISMS processes. However, and in spite of its importance, an ISMS process framework with a description of ISMS processes and their interaction as well as the interaction with other management processes is not available in the literature. Cost benefit analysis of information security investments regarding single measures protecting information and ISMS processes are not in the focus of current research, mostly focused on economics. This article aims to fill this research gap by proposing such an ISMS process framework as the main contribution. It is based on a set of agreed upon ISMS processes in existing standards like ISO 27000 series, COBIT and ITIL. Within the framework, identified processes are described and their interaction and interfaces are specified. This framework helps to focus on the operation of the ISMS, instead of focusing on measures and controls. By this, as a main finding, the systemic character of the ISMS consisting of processes and the perception of relevant roles of the ISMS is strengthened.

What do we know about information security governance?

“…However, there is no common and general view on what and how it should be done to ensure unimpeded and resilient processes of security (Kauspadiene et al , 2017). Although researchers have answered the long-heard call for more empirical and validated models (Knapp et al , 2009; Maleh et al , 2017; Haufe et al , 2016; Nicho, 2018), most of the ISG models created up until now still lack theory and empirical validation, are generic or universal in scope, are static and do not acknowledge the importance of social and behavioural factors (McFadzean et al , 2007; Siponen and Willison, 2009; Williams et al , 2013; Flores et al , 2014; Mishra, 2015). This leads to two main general issues that hinder ISG in the digital business context.…”

“…3.3.1 Information security governance models in practice. Well-known ISG practical frameworks include ISO standards such as the 27001 and 38500 series, multiple standards from the National Institute of Standards and Technology (NIST), the Control Objectives for Information and related Technology methodology for IT controls and Information Technology Infrastructure Library practices for managing IT operations (Haufe et al, 2016;Bobbert, 2018). Many of these good practices are well established and are supported by a wide range of industry solutions.…”

“…Knapp et al (2009) focus on the IS policy process by showing a larger organisational context that includes key external and internal influences that can materially impact organisational processes. Haufe et al (2016) suggest a process framework to help focus on the operation of an Information Security Management System instead of focusing only on measures and controls. Carcary et al (2016) explain that approaches to ISG must be fluid and responsive to the changing IS landscape.…”

Digital Security Governance

“…Knapp et al (2009) focus on the IS policy process by showing a larger organisational context that includes key external and internal influences that can materially impact organisational processes. Haufe et al (2016) suggest a process framework to help focus on the operation of an Information Security Management System (ISMS) instead of focusing only on measures and controls. Carcary et al (2016) explain that approaches to ISG must be fluid and responsive to the changing IS landscape.…”

“…However, there is no common and general view on what and how should be done to ensure unimpeded and resilient processes of security (Kauspadiene, 2017). Although researchers have answered the long-heard call for more empirical and validated models (Knapp et al, 2009;Maleh et al, 2017;Haufe et al, 2016;Nicho et al 2018), most of the ISG models created up until now still lack theory and empirical validation, are generic or universal in scope, are static and do not acknowledge the importance of social and behavioural factors Siponen & Willison 2009;Williams et al, 2013;Mishra, 2015). This leads to two main general issues that hinder ISG in the digital business context.…”