It is a truism to say that information is the currency of the information age. Information is, in many cases, the most valuable asset possessed by an organisation, even if that information has not been subject to a formal and comprehensive valuation.
IT governance is the discipline that deals with the structures, standards and processes that boards and management teams apply in order to effectively manage, protect and exploit their organisation’s information assets.
Information security management is the subset of IT governance that focuses on protecting and securing an organisation’s information assets.
Risks to information assets
An asset can be defined as ‘anything that has value to an organisation’. Information assets are subject to a wide range of threats, both external and internal, ranging from the random to the highly specific. Risks include acts of nature, fraud and other criminal activity, user error and system failure.
Information Security Management System
An Information Security Management System (ISMS) is defined (in ISO/IEC 27000) as ‘part of the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security. The management system includes organisational structure, policies, planning activities, responsibilities, practices, procedures, processes and resources’.