Dejan Kosutic

Traditionally, information security has been perceived as an activity that was built around protecting sensitive information assets – after all, this is what the first (2005) revision of ISO 27001, and its predecessor BS 7799-2, also emphasized. These standards required companies to identify all the assets, and then build the ...

The post Should information security focus on asset protection, compliance, or corporate governance? appeared first on 27001Academy.

There is one requirement of ISO 27001 that is very rarely mentioned, and yet it is probably crucial for the long-term “survival” of an Information Security Management System (ISMS) in a company: this is the requirement from clause 5.1 that says that top management needs to ensure that the information security ...

The post Aligning information security with the strategic direction of a company according to ISO 27001 appeared first on 27001Academy.

Very often, I hear controversial discussions about whether information security is part of IT, or whether it should be separate from it, part of some compliance or risk department, etc. But, before we determine who should be handling information security and from which organizational unit, let’s see first the conceptual ...

The post Where does information security fit into a company? appeared first on 27001Academy.