Outcomes of Information Security Program Management
Effective information security program management should achieve the outcomes defined in ISG. The necessary goals must be defined in specific, objective and measurable terms. Appropriate metrics should also be put in place to measure whether or not the goals were achieved. If not, it should be known by how much the objectives were missed, and discussion done to improve on performance.
Candidates should focus on the following six outcomes, and they should be considered as the basis for developing the objectives of an effective information security program:
Strategic alignment: The emphasis here is on organizational information risk, selection of appropriate control objectives and standards, agreement on acceptable risk and risk tolerance and definitions of financial, operational and other constraints.
Risk management: Candidates must show a comprehensive understanding of threats the organization faces, its vulnerabilities and risk profile. Candidates must know how to evaluate the potential impacts of threats that materialize, and know approaches involved in reducing risks to an acceptable level.
Also read : 3 domains of information security
Candidates should focus on the following six outcomes, and they should be considered as the basis for developing the objectives of an effective information security program:
Strategic alignment: The emphasis here is on organizational information risk, selection of appropriate control objectives and standards, agreement on acceptable risk and risk tolerance and definitions of financial, operational and other constraints.
Risk management: Candidates must show a comprehensive understanding of threats the organization faces, its vulnerabilities and risk profile. Candidates must know how to evaluate the potential impacts of threats that materialize, and know approaches involved in reducing risks to an acceptable level.
Also read : 3 domains of information security
Comments
Post a Comment