Information security management system consists of set activities designed and implemented to manage information security needs of an organization in rigorously changing information security industry. Information security management system is specifically concerned with the integration of information security measures in a coherent program which ensures efficiency and effectiveness of resources. It ensures integrity of data with continuous and coordinated security measures along with measures to make information assets available with exposure to minimum information security risks.
The information Security Management System is commonly known as ISMS and arises primarily out of ISO/IEC 27001. The standard helps in regulatory compliance measures with clearly defined controls and proper check methodologies.
An effective and efficient ISMS system is having capability to accept any change in the internal organization and external environment and capable of delivering long term objectives. Continuous improvement and regular update are necessary for increasing compatibility of an information security management system with evolving information security industry.
Plan to Do Check Act (PDCA) is designed by ISO/IEC 27001 to facilitate continuous development in information security management system and increase efficiency or security measures. This act is increasingly emphasized on designing and implementing Information security management system in four steps namely Plan, Do, Check and Act.
Plan refers to screening, assessment and designing control for reducing risk in information security management system. In second step define controls are implemented while Check step refers to critical appraisal of implemented information security measures. If any deficiencies are found during review then they are fixed through effective change management in act step.
|
