A cyclical evaluation model of information security maturity. Issue 3 (8th July 2014)

• Record Type: Journal Article
• Authors: Alencar Rigon, Evandro; Merkle Westphall, Carla; Ricardo dos Santos, Daniel; Becker Westphall, Carlos
• Is Part Of: Information management & computer security. Volume 22:Issue 3(2014)
• Page Start: 265
• Page End: 278
• Publication Date: 2014-07-08
• Subjects: Security -- Risk -- Maturity; Information technology -- Management -- Periodicals; Management information systems -- Periodicals; Computer security -- Periodicals; 658.05
• DOI: 10.1108/IMCS-04-2013-0025
• Languages: English
• ISSNs: 0968-5227

Abstract

Abstract : Purpose: – This paper aims at presenting a cyclical evaluation model of information security (IS) maturity. The lack of a security evaluation method might expose organizations to several risky situations. Design/methodology/approach: – This model was developed through the definition of a set of steps to be followed to obtain periodical evaluation of maturity and continuous improvement of controls. Findings: – This model, based on controls present in ISO/IEC 27002, provides a means to measure the current situation of IS management through the use of a maturity model and provides a subsidy to take appropriate and feasible improvement actions, based on risks. A case study is performed, and the results indicate that the method is efficient for evaluating the current state of IS, to support IS management, risks identification and business and internal control processes. Research limitations/implications: – It is possible that modifications to the process may be needed where there is less understanding of security requirements, such as in a less mature organization. Originality/value: – This paper presents a generic model applicable to all kinds of organizations. The main contribution of this paper is the use of a maturity scale allied to the cyclical process of evaluation, providing the generation of immediate indicators for the management of IS.