Journal of Emerging Trends in Economics and Management Sciences: Home

Article Title:
Analysis of management of Information security and related Enterprise risks in view of ISO/IEC 27001:2013
by Ashish Ukidve and Milind Tadvalkar

Abstract:
International Organization for Standardization (ISO) and IEC- International Electrotechnical Commission formally released the updates to ISO/IEC 27001 and 27002. The last time these standards were updated was in 2005. Even though ISO/IEC 27001:2005 generally talked about monitoring the ISMS implementation, it did not clearly specify importance of having a formal documented plan or justification for monitoring specific processes and controls. The revised version of ISO/IEC 27001:2013 has set the stage for significant structural changes in the standard?s individual sections with the introduction of alterations as well the number of new information security controls. Even though the text and requirements from the previous version of the standard are still there, they have been adapted to fit new and growing topics. This paper presents study and comparison of the previous and new standards and tries to identify alignment of information security with enterprise risk management using the new version of the standard. This would enable organizations in improving corporate governance and information security risk management with Enterprise Risk Management activities.

Keywords: ISMS, ISO27001:2013, corporate governance, enterprise risk, Strategic risk management

Download full paper