Security Management

Introduction

The planning, management, and monitoring role that is essential to setting up and continuously implementing a well thought-out and effective process for maintaining information security is referred to as (information) security management. A properly functioning security management process must be embedded into the existing management structures of every organisation. For this reason, it is practically impossible to specify an organisational structure for security management that is directly applicable to every organisation. Instead, such structures often need to be adapted to the specific conditions of the organisation at hand.

Objective

The objective of this module is to illustrate how a functioning information security management system (ISMS) can be established and developed further during live operations. To accomplish this, the module describes a systematic security process and provides instructions for creating a security concept.

Scoping and Modelling

Module ISMS.1 Security Management must be applied once to the entire information domain under consideration.

The module is based on the BSI Standards 200-1, “Information Security Management Systems (ISMS)”, and 200-2, “IT-Grundschutz Methodology”. It summarises the most important aspects of security management.

Security audits should be carried out in organisations on a regular basis. Detailed requirements for this are not covered in this module; they can be found in module DER 3.1 Audits and Revisions. The security risk awareness of all an organisation's employees and other relevant persons (such as external employees or project members) should be raised in a suitable and systematic manner for each target group. These individuals should also be trained in aspects of information security. Detailed requirements for this can be found in ORP.3 Awareness and Training in Information Security.

This module does not deal with specific aspects of human resources or organisation. These requirements are dealt with in the modules ORP.2 Personnel and ORP.1 Organisation.

Useful Resources

The BSI Standard 200-1 defines general requirements of an information security management system (ISMS). It is also compatible with the ISO 27001 standard and includes the recommendations of many other ISO standards.

BSI Standard 200-2 forms the basis of the proven BSI methodology for the development of a sound information security management system (ISMS). It establishes three new approaches to the implementation of IT-Grundschutz. Since standards 200-1 and 200-2 have a similar structure, users can easily navigate within both documents.

ISO/IEC 27000 ("Information Security Management Systems — Overview and Vocabulary") provides an overview of information security management systems (ISMS) and the connections among the various standards of the ISO/IEC 2700x family. Furthermore, the standard includes the basic terms and definitions pertaining to an ISMS.

The ISO/IEC 27001 standard ("Information Security Management Systems – Requirements) is an international standard on information security management for which certification can also be obtained.

ISO/IEC 27002 ("Code of Practice for Information Security Controls") supports the selection and implementation of the safeguards described in ISO/IEC 27001 in order to establish a working security management system and embed it in an organisation.