Information security management

Information security management (ISM) defines and manages controls that an organization needs to implement to ensure that it is sensibly protecting the confidentiality, availability, and integrity of assets from threats and vulnerabilities. The core of ISM includes information risk management, a process that involves the assessment of the risks an organization must deal with in the management and protection of assets, as well as the dissemination of the risks to all appropriate stakeholders.[1] This requires proper asset identification and valuation steps, including evaluating the value of confidentiality, integrity, availability, and replacement of assets.[2] As part of information security management, an organization may implement an information security management system and other best practices found in the ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27035 standards on information security.[3][4]

  1. ^ Campbell, T. (2016). "Chapter 1: Evolution of a Profession". Practical Information Security Management: A Complete Guide to Planning and Implementation. APress. pp. 1–14. ISBN 9781484216859.
  2. ^ Tipton, H.F.; Krause, M. (2003). Information Security Management Handbook (5th ed.). CRC Press. pp. 810–11. ISBN 9780203325438.
  3. ^ Humphreys, E. (2016). "Chapter 2: ISO/IEC 27001 ISMS Family". Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House. pp. 11–26. ISBN 9781608079315.
  4. ^ Campbell, T. (2016). "Chapter 6: Standards, Frameworks, Guidelines, and Legislation". Practical Information Security Management: A Complete Guide to Planning and Implementation. APress. pp. 71–94. ISBN 9781484216859.