The ISSO must understand the business and management environment

✍ Scribed by Gerald Kovacich

• Publisher: Elsevier Science
• Year: 1997
• Tongue: English
• Weight: 683 KB
• Volume: 16
• Category: Article
• ISSN: 0167-4048
• DOI: 10.1016/s0167-4048(97)80196-4

✦ Synopsis

The objective of this article, is to provide the ISSO (Information Systems Security Officer) with a basic understanding and philosophy of information systems security (InfoSec) within the business environment, to include how to communicate with management in 'their language'.

Understanding the Business Environment

An InfoSec programme and organization is not the reason that a business or government agency exists. In the case of a business, the company usually provides a service or a product. The business has certain information or systems which are vital to performing its service and producing its product.The purpose of an InfoSec programme therefore, is to provide sewice and support to the business.

In order to adequately meet the needs of its customers, it is imperative for the ISSO to understand the company and the company's business. This includes the following: