Information Security Assessment
What should be assessed in an information security assessment?
In a nutshell everything, at least as it's related to the security of information in all of its forms.
On characteristic of good information security and one that provides the most value is holistic application. It is easy for an organization to put information security into an "IT box", but doing so puts the organization at unnecessary risk and misses much of the value that can be gained from good information security.
Granted, there are many IT controls employed by information security and there is often a close working relationship with IT, but it is important to note that information security is NOT an IT issue. Information security is no more an IT issue as it is an accounting issue, or a legal issue, or a sales issue. You get the picture.
As an example, let's look at the scope of an ISO 17799:2005 assessment. The ISO 17799:2005 assessment is the type of assessment most often used by FRSecure and our clients.
From the International Organization for Standardization (ISO):
ISO/IEC 17799:2005 contains best practices of control objectives and
controls in the following areas of information security management:
* security policy;
* organization of information security;
* asset management;
* human resources security;
* physical and environmental security;
* communications and operations management;
* access control;
* information systems acquisition, development and
maintenance;
* information security incident management;
* business continuity management;
* compliance.
Questions? If so, please use the form below to contact FRSecure. We will promptly and courteously get back to you!
Copyright � 2009 FRSecure LLC All Rights Reserved.