A framework for information security governance and management

Daily changes in the information security landscape mean that organizations face unprecedented challenges in securing their information systems. It appears easy for organizations to adopt a tactical approach in which they respond to problems as they occur. However, when such a paradigm exists, it becomes difficult to act strategically. What is required is for organizations to be able to assess their current maturity state with respect to information security governance and management, and to proactively identify problem areas that need to be addressed. Here, the authors present a capability maturity framework to support organizations in this activity. The framework addresses the technical, process, and human aspects of information security and provides insight and guidelines for organizations to implement effective information security governance and management processes.