Considerations on the implementation steps for an information security management system

This study examines the effect of an Information Security Management System (ISMS) on organizational performance in a Small and Medium Business (SMB), with a focus on Red Mango Ltd. The study employed a correlational survey design to assess the relationship between ISMS implementation and organizational performance. Primary data was collected from 44 respondents, including management and staff, through structured questionnaires. The convenience sampling technique was used for respondent selection, and data analysis was conducted using the Statistical Package for Social Sciences (SPSS) version 25. Correlation and regression analyses were applied to determine the relationship and effect of ISMS on organizational performance. Findings revealed that ISMS is well-implemented at Red Mango Ltd, with clear policies, structured roles and responsibilities, and comprehensive employee training on security measures. Employees are well-informed about acceptable usage of information security systems, and security incidents are promptly reported. However, several challenges hinder ISMS implementation, including leadership issues, technical system difficulties, personnel constraints, and financial limitations. Despite these challenges, ISMS adoption has led to significant benefits, including regulatory compliance, optimized business processes, cost savings, improved information security awareness, enhanced company reputation, and increased productivity. The study further established a strong positive correlation between ISMS implementation and organizational performance at Red Mango Ltd. Regression analysis indicated that a unit increase in ISMS adoption results in a 0.495 increase in organizational performance, confirming its significant impact. The study concludes that effective ISMS implementation enhances security, improves operational efficiency, and contributes to overall business success. Organizations are encouraged to address implementation challenges through leadership commitment, technical capacity building, and financial investment to fully realize ISMS benefits.

This paper proposes a technique for the design and implementation of the information security management system (ISMS) for small and medium enterprises (SMEs). The technique is based on ISO 27001 standard ISMS requirements object model. The model was designed using methods and tools of the information security integral engineering (ISIE) framework, so the first part of the paper also briefly describes some features, components and engineering methods within the ISIE framework, which are important in practical applications but were presented insufficiently or were not presented at all in the previous papers. Along with the description of a general ISMS design and implementation method, the paper provides an example of the application of this method to design ISMS for city medium telecommunication SME. The paper also gives the evaluation of the technique's efficiency.

Information Security Management System (ISMS) implementation in Institution is an effort to minimize information security risks and threats such as information leakage, application damage, data loss and declining IT network performance. The several incidents related to information security have occurred in the implementation of the Academic System application in Indonesian higher education. This research was conducted to determine the maturity level of information security practices in Academic Information Systems at universities in Indonesia. The number of universities used as research samples were 35 institutions. Compliance with the application of ISO 27001:2013 standard is used as a reference to determine the maturity level of information system security practices. Meanwhile, to measure and calculate the level of maturity using the SSE-CMM model. In this research, the Information System Security Index obtained from the analysis results can be used as a tool to measure the maturity of information security that has been applied. There are six key areas examined in this study, namely the role and importance of ICT, information security governance, information security risk management, information security management framework, information asset management, and information security technology. The results showed the level of information security maturity at 35 universities was at level 2 Managed Process and level 3 Established Process. The composition is that 40% of universities are at level 3, and 60% are out of level 3. The value of the gap between the value of the current maturity level and the expected level of maturity is varied for each clause (domain). The smallest gap (1 level) is in clause A5: Information Security Policy, clause A9: Access Control, and clause A11: Physical and environmental security. The biggest gap (4 levels) is in clause A14: System acquisition, development and maintenance and clause A18: compliance.  Â

In the wave of the progressive informatization process, Korean enterprises are making a vast amount and range of investments in the information security sector in order to counter the information dysfunction. In addition, to achieve an objective evaluation thereon, they have been increasingly exhibiting a preference for a certification system of information security management, as developed by the government This study aims to reduce the possible trials and errors while promoting the establishment and certification of the information security management system by enterprises. To satisfy this purpose, this study presents the defects by item found during the certification process of the information security management system of a number of enterprises. By analyzing the derived defects, we have outlined the issues to be attended to among enterprises at each stage of the establishment of an information security management system. The study also presents a reference model for conducting a self check, so that companies may be able to self-verify the completeness of their establishment of the information security management system. Through the results of this study, enterprises will be able to self-verify their completeness levels when promoting the establishment and certification of the information security management system, and improve the efficiency and effectiveness thereof so as to raise the general level and awareness among enterprises of the importance of information security.

The purpose of this study was to investigate and analyze the assumptions and requirements for the implementation of Information Security Management System (ISMS). Methodology: To check assumptions security management system implementation is the population of Tabriz hospitals. Review the requirements and assumptions are based on the standard ISO / IEC 27001, ISO / IEC 27002 test target setting and ISO 27001 standard questionnaire containing 33 questions in 11 control is used. The data were analyzed using descriptive and inferential statistical method that factors in the implementation of information security management system was confirmed. As well as to identify factors contributing to the implementation of information security management system and factor analysis, structural equation model was used PLS smart software that based on its findings to impact and indirect aspects of implementation effectiveness of the system. Results: Using the software, smart-PLS and using structural equation modeling confirmatory factor analysis was performed to measure the test of convergent validity, divergent validity, reliability Security and reliability of observable variables and quality test and measurement model of the 101 comments experts, all the prerequisites and requirements, including information security policy, the organization of information security, asset management, human resources in terms of security, physical and environmental security, communications and operations management, access control, use, development and maintenance, incident management information security, business continuity management and compliance with laws in secure level at %99 is forecast in Tabriz hospitals are effective information security management system. Conclusion: According to prioritize the factors affecting information security management system, operating (after) the most monitors and agents (after) the supply and implementation of information security management system least affected are in Tabriz hospitals.

Information Security (IS) Risk Assessment is a main part of risk analysis; it helps organizations make decisions to protect their Information Technology (IT) services and underlying IT assets from potentially adverse events. How to do assessment in this context, however, is not a well defined task. Some approaches provide guidelines but leave analysts to define how to implement them, leading to different mechanisms to identify input data, different procedures to process those inputs, and different results as a consequence. To address this problem, we present a semiautomatic procedure, based on data systematically obtained from modern IT Service Management (ITSM) tools used by IT staff to handle IT services’ assets and configurations. We argue that these tools handle actual data that may be used to collect inputs for a IS risk assessment procedure, thus reducing subjective values. We evaluated the procedure in a real case study and found that our approach actually reduces variability of some results. We also identified areas that must be addressed in future work.

The article justifies the imperatives of applying the situational approach to information security management (ISM). We modified the model of the Information Security Management System (ISMS), which is the basis of ISO/IEC 27005: 2011: we added the “Decision Making” stage after the “Determining the main criteria” step. The solution is to choose an approach to proccesing information security risks — their assessment, impact and taking — based on certain criteria. Using the developed algorithm, we implemented a cognitive software module of the information system management (ISM) in an educational institution. The use of the cognitive software module has significantly reduced the labor costs of specialists in the Information Security (IS) Department, including automation of the reporting procedures. The application of the situational approach allowed us to integrate a person into the automated system to ensure the cybersecurity of the educational sector.

This paper examines using a requirements management tool as a common thread to managing the complexity of information security systems. Requirements management provides a mechanism to trace requirements through to design, implementation, operating, monitoring, reviewing, testing, and reporting by creating links to associated, critical artefacts. This is instrumental in managing complex and dynamic systems where change can impact other subsystems and associated documentation. It helps to identify the affected artefacts through many layers. Benefits to this approach would include better project planning and management, improved risk management, superior change management, ease of reuse, enhanced quality control and more effective acceptance testing. It would also improve the ability to audit, especially at a time when outsourcing of security functions is occurring throughout the world. ISO 27001:2006 provides a model for the implementation of an Information Security Management System (ISMS) that can be tailored by an organization. It is proposed that employment of a requirements management tool could manage the traceability aspects of an ISMS.

The growth of computers and of information technology has been explosive. As a result, information technology has been widely applied in every aspect of our life—from business, government, education, finance, health-care, aerospace to national defence. Computers, especially networked computers, have brought benefits to us and improved our lives. However, surveys and reports from various industry associations and security organizations suggested that only a few organizations can successfully protect their information assets. Organizations realize that information security is a complex issue, involving both human and technical factors. This paper is an attempt to empirically assess the maturity of Information Security Management System (ISMS) implementation in selected IT Service organizations in terms of confidence of their employees on their Information Security Management System.

The subject of research in the article is the management of vulnerabilities in the information security management system. The purpose of the work is to consider modern standards that establish and regulate the management of vulnerabilities and risks associated with vulnerabilities. The article considers the process of integration of vulnerability management into information security management system and its form. Conclusions: modern information security management system does not properly take into account vulnerabilities and risks associated with vulnerabilities, the current regulatory framework of Ukraine almost does not regulate and does not set requirements for information security systems in the field of vulnerabilities. Currently, the processes of risk management and assessment are entrusted to administrators, so effective management of vulnerabilities requires a clear system of rules and methodologies. The development of such a system is a promising task, and in the process of modernization of standards, requirements of Ukraine after some time will become a necessity. When adding a quality vulnerability assessment system, such a system will be clear, standardized and will serve as a guide to action in a particular situation

Contemporary methods for assessing information security risks have adopted mainly technical views on the information and technology assets. Organizational dynamics of information management and knowledge sharing have gained less attention. This article outlines how an information security risk assessment method can be elaborated using knowledge-centric analysis of information assets. For this purpose, we suggest the use of a genre-based analysis method for identifying organizational communication patterns, through which organizational knowledge is shared. Initial experiences of the method try-outs by three experienced information security professionals are discussed. The article concludes with a look at the implications of a genre-based analysis of knowledge assets for future research and practice.

Conducting a risk assessment (RA) for cloud computing platforms presents new challenges in the space of Information Security Management Systems (ISMS). ISO 27001 RA methods have been used for the Alcohol Monitoring Systems (AMS) ISMS across a portfolio of products and services. Scaling these localized techniques to national and international cloud security standards shows that a ‘one size fits all’ risk assessment approach does not exist in the industry today. The context and methods for conducting cloud risk assessment are examined across representative national and international standards and guidelines. Recommendations for standardizing the RA methods for cloud computing are suggested based on industry best practices.

To date, the issue of security of information system resources in the presence of threats in the global information sphere is one of the most urgent both in Russia and in the world. This is due to stricter requirements for companies that store and process personal data. Recently, more and more companies of large and medium-sized businesses regularly face the resolution of incidents related to data loss as a result of cyber attacks or violation of established information security regulations by the company's personnel. In this regard, priority attention to information security has become a necessity for running a successful business. An information security management system — ISMS) is a part of an organization's overall management system based on a risk-based approach to managing information security. SMIB allows not only to minimize the risks associated with information security, but also can give a serious competitive advantage in the global market.

The issue of creating an information security system is very relevant in the world today. One of the urgent tasks is to solve the issues of effective protection of information from both external and internal threats through the creation and implementation of information security management systems in automated systems of enterprises, which, among other things, requires the formalization of the task of protecting information for its subsequent implementation by software and other means. Now there are security analysis systems, for example, that examine the security elements settings of workstations and servers operating systems, analyze the network topology, look for unprotected network connections, examine the settings of firewalls. The disadvantage of these systems is that they are not suitable for monitoring large volumes of network traffic. The solution to this problem is the use of monitoring tools capable of analyzing large amounts of data in real time. Therefore, a significant place in the article is given to the review of developments based on artificial intelligence technologies, namely multi-agent systems, review of information security models, threat risk assessment in automated systems. The functional architecture of the information security management system based on a multi-agent system has been proposed to search in real time for information security optimal solutions through the selection of such coalitions of protection mechanisms agents that will allow to build the optimal protection of the automated system according to the selected criteria. The model with complete overlapping of threats has been substantiated and adopted as a basis, which allows to analyze the overall situation and choose strategically important decisions directly during the organization of information security. The essence of of multi-agent systems functioning that implement a decentralized control system based on the work of autonomous agents that can be implemented programmatically has been revealed. The role of threat agents, resource agents, agents of protection mechanisms and their functional purpose have been defined. The problem of searching a set of protection mechanisms agents coalition for the current state of the automated system as a problem of optimal search by the criterion of protection cost, taking into account the value of information, has been generalized. Due to the modularity of the multi-agent system, the further work will be aimed at detailing its components and perfection.

Purpose – Information security has become an essential entity for organizations across the globe to eliminate the possible risks in their organizations by conducting information security risk assessment (ISRA). However, the existence of numerous different types of risk assessment methods, standards, guidelines and specifications readily available causes the organizations to face the daunting tasks in determining the most suitable method that would augur well in meeting their needs. Therefore, to overcome this tedious process, this paper suggests collective information structure model for ISRA. Design/methodology/approach – The proposed ISRA model was developed by deploying a questionnaire using close-ended questions administrated to a group of information security practitioners in Malaysia (N = 80). The purpose of the survey was to strengthen and add more relevant additional features to the existing framework, as it was developed based on secondary data. Findings – Previous comparative and analyzed studies reveals that all the six types of ISRA methodologies have features of the same kind of information with a slight difference in form. Therefore, questionnaires were designed to insert additional features to the research framework. All the additional features chosen were based on high frequency of more than half percentage agreed responses from respondents. The analyses results inspire in generating a collective information structure model which more practical in the real environment of the workplace. Practical implications – Generally, organizations need to make comparisons between methodologies and decide on the best due to the inexistence of agreed reference benchmark in ISRA methodologies. This tedious process leads to unwarranted time, money and energy consumption. Originality/value – The collective information structure model for ISRA aims to assist organizations in getting a general view of ISRA flow and gathering information on the requirements to be met before risk assessment can be conducted successfully. This model can be conveniently used by organizations to complete all the required planning as well as to select the suitable methods to complete the ISRA.