Vol.24-Issue2-2015-TIGANOAIA

Bogdan TIGANOAIA
Politehnica University of Bucharest,
313, Splaiul Independentei, Bucharest, Romania
bogdantiganoaia@gmail.com

Abstract: Information security in an organization is one of the most important pillars in achieving organizational objectives. It does not produce profit but it offers the necessary framework for efficiency and efficacy in organization. Information security can be provided in an organization through the implementation and certification of an ISMS–Information Security Management System. This paper presents some aspects regarding the information security management system in an organization and underlines the importance of the adoption of an ISMS and the new elements in ISO/IEC 27001:2013 (new concepts, requirements and changes introduced in the standard). An analysis regarding the correlation between the business risks and features & advantages of the ISO/IEC 27001 standard is presented. There is also proposed a guide for adopting the ISO/IEC 27001:2013 standard, which implies a self-assessment of the organization (which allows to identify where the organization in the ISO/IEC 27001 process is) and strategies (concrete steps and the allocation of resources). The proposed guide will help the organization to understand the relationship between ISO/IEC 27001:2013 and its predecessor ISO/IEC 27001:2005.

Keywords: Information security, standards, management systems, organizations, ISO/IEC.

>Full text
CITE THIS PAPER AS:
Bogdan TIGANOAIA, Some Aspects Regarding the Information Security Management System within Organizations – Adopting the ISO/IEC 27001:2013 Standard, Studies in Informatics and Control, ISSN 1220-1766, vol. 24 (2), pp. 201-210, 2015. https://doi.org/10.24846/v24i2y201508

1. Introduction

In the territories that present social and public order conflicts, information management and timely access to it, is of vital importance as it contributes to the understanding of the nature of the conflicts that arise [1]. If we refer to an organization, according to B.S.I. Group (British Standards Institution), successful businesses understand the value of timely, accurate information, good communications and secrecy. Information security is as much about exploiting the opportunities of our interconnected world as it is about risk management. That’s why organizations need robust information security management [2]. According to Pipkin, information security is the process of protecting the intellectual property of an organization [3]. All models related to the measurement of information security success are mostly driven by financial performance indicators, and not by psychological or other non-economic goals [8]. One durable and well-known way to achieve security for organizational information is through the implementation and then certification, through a certification body, of an ISMS – Information Security Management System, according to the international standard ISO/IEC 27001:2005, with its revised version in 2013. An information security management system is a set of managerial interconnected processes having the target to establish the right direction regarding information security in organization. It is important to stress the necessity of having an ISO/IEC 27001 certified organization. Why adopt an information security management standard?