80% of large organisations have established an information security management strategy, but less than 50% of these organisations have received sufficient buy-in from the rest of the organisation to implement it.
"Security and privacy are not necessarily mutually supportive. In several respects, the more information security we introduce, the greater the threat to individual's privacy. This paradox is no better represented than in the debate over the introduction of identity cards in Britain at present"
Trevor Lea-Cox, Global Information, Systems and Technology consultant (Planning and Strategy, Intellectual Capital Management and Information Security Management)
MWR InfoSecurity's information security management implementation framework is designed to integrate with established corporate disciplines, especially the organisation's strategy development and approval process. The following is a summary of the overall Information Security Management process in this context.
Key activities:
1. Plan the initial set up project
2. Identify the current information security risks and their context
3. Review the performance and condition of the current information security management infrastructure
4. Identify / update the information security Policy and Strategy
5. Identify / update the ISMS Operating and Development Plans
6. Obtain Board approval for these plans as part of the organisation's main strategy development process
7. Implement the ISMS Development Plan
8. Manage and operate the ISMS
Information Security:
Some Challenging Issues and Questions
The following questions and issues provide a good background for a sensible discussion about information security:
Full project documentation
The project consists of a series of one-day workshops, interspersed with preparatory work. Typically the project is completed within 1-2 months and is managed and facilitated by a senior consultant.
The workshops encourage (and in many instances, require) managers from other functions to participate. Their input is often critical in gaining organisation-wide commitment.
MWR InfoSecurity Information Security Management programme:
Key Benefits
A greater awareness of the organisation's information security issues and exposures, especially at the Board level. Key exposures are identified and addressed on a priority basis. This often leads to some "quick wins".
