Abstract
An Information Security Management System, according with the ISO/IEC 27001 is the set of “that part of the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security”. ISO/IEC 27001 defines the requirements and process for implementing an Information Security Management System. However, implementing this standard without a detailed plan can become a burden on organizations. This paper presents a maturity model for the planning, implementation, monitoring and improvement of an Information Security Management System based on ISO/IEC 27001. The purpose of this model is to provide an assessment tool for organizations to use in order to get their current Information Security Management System maturity level. The results can then be used to create an improvement plan which will guide organizations to reach their target maturity level. This maturity model allows organizations to assess their current state of affairs according to the best practices defined in ISO/IEC 27001. The maturity model proposed in this paper is evaluated through a multi-step perspective that is used to confirm that the maturity model makes a useful and novel contribution to the Information Security Management domain by taking in consideration the best practice of the domain.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Dubois, E., Heymans, P., Mayer, N., Matulevicius, R.: A systematic approach to define the domain of information system security risk management. In: Nurcan, S., Salinesi, C., Souveyet, C., Ralyté, J. (eds.) Intentional Perspectives on Information Systems Engineering, pp. 289–306. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-12544-7_16
ISO/IEC 27001:2013, Information technology - Security techniques - Information security management systems – Requirements (2013)
Miller, H., Murphy, R.: Secure cyberspace: answering the call for intelligent action. IT Professional (2009)
CMMI Product Team: CMMI for Development, Version 1.3, Carnegie Mellon Univ., no. November, p. 482 (2010)
Mettler, T.: A design science research perspective on maturity models in information systems. Institute of Information Management, University of St. Gallen, St. Gallen (2009)
The Open Group: Open Information Security Management Maturity Model (O-ISM3) (2011)
Carnegie-Mellon-University: Systems Security Engineering Capability Maturity Model (SSE-CMM) - Model Description Document. Version 3.0 (2003)
ISF: Time to grow using maturity models to create and protect value, in Information Security Forum ISF (2014)
IT Governance Institute: COBIT 5 – A business Framework for the Governance and Management of Enterprise IT (2012)
Department of Energy, U.S. Department of Homeland Security, Cybersecurity Capability Maturity Model (C2M2 v1.1) (2014)
McGraw, G., Migues, S., West, J.: Building Security in Maturity Model (BSIMM) Version 8 (2015)
Mettler, T., Rohner, P., Winter, R.: Towards a classification of maturity models in information systems. In: D’Atri, A., De Marco, M., Braccini, A., Cabiddu, F. (eds.) Management of the Interconnected World. Physica-Verlag, Heidelberg (2010). https://doi.org/10.1007/978-3-7908-2404-9_39
De Bruin, T., Freeze, R., Kaulkarni, U., Rosemann, M.: Understanding the main phases of developing a maturity assessment model. In: Proceedings of the Australasian Conference on Information Systems (ACIS) (2005)
Poeppelbuss, J., Niehaves, B., Simons, A., Becker, J.: Maturity models in information systems research: literature search and analysis. In: Communications of the Association for Information Systems, vol. 29 (2011)
van Loon, H.: Process Assessment and Improvement: A Practical Guide. Springer, New York (2015)
Becker, J., Knackstedt, R., Pöppelbuβ, J.: Developing maturity models for IT management: a procedure model and its application. Bus. Inf. Syst. Eng. 3, 213–222 (2009)
Hevner, A., Ram, S., March, S., Park, J.: Design science in information systems research. MISQ 28, 75–105 (2004)
Vom Brocke, J.: Design principles for reference modeling-reusing information models by means of aggregation, specialization, instantiation, and analogy. In: Fettke, P., Loos, P. (eds.) Reference Modeling for Business Systems Analysis. Idea Group Inc., Hershey (2007)
Hevner, A., Chatterjee, S.: Design Research in Information Systems: Theory and Practice. Springer, Heidelberg (2010). https://doi.org/10.1007/978-1-4419-5653-8
Wand, Y., Weber, R.: On the ontological expressiveness of information systems analysis and design grammars. Inf. Syst. J. 3(4), 217–237 (1993)
Acknowledgements
This work was supported by national funds through Fundação para a Ciência e a Tecnologia (FCT) with reference UID/CEC/50021/2013.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer International Publishing AG, part of Springer Nature
About this paper
Cite this paper
Proença, D., Borbinha, J. (2018). Information Security Management Systems - A Maturity Model Based on ISO/IEC 27001. In: Abramowicz, W., Paschke, A. (eds) Business Information Systems. BIS 2018. Lecture Notes in Business Information Processing, vol 320. Springer, Cham. https://doi.org/10.1007/978-3-319-93931-5_8
Download citation
DOI: https://doi.org/10.1007/978-3-319-93931-5_8
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-93930-8
Online ISBN: 978-3-319-93931-5
eBook Packages: Computer ScienceComputer Science (R0)