Information Security Risk Management for ISO 27001/ISO 27002, third edition

INTRODUCTION

In today’s information economy, the development, exploitation and protection of information and associated assets are key to the long-term competitiveness and survival of corporations and entire economies. The protection of information and associated assets – information security – is therefore overtaking physical asset protection as a fundamental corporate governance responsibility. An information security management system (ISMS)that provides “a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization’s information security to achieve business objectives”¹ has become a critical corporate discipline, alongside marketing, sales, HR and financial management.