Assessment of information technology (IT) services and development of issue-specific security policies of a government agency using ISO/IEC 27001:2013 standard
Clicks: 3
ID: 285529
2023
Article Quality & Performance Metrics
Overall Quality
Not rated
Combines reader engagement with the AI quality analysis. This
article has not been analysed, so there is no overall score —
reader engagement is measured and shown alongside.
Reader Engagement
Steady Performance
0.6
/100
3 views
0 readers
AI Quality Assessment
Not analyzed
Readership in this journal
SteadyRanked #852 of 3,757 articles by views in Malay Journal
Most read
Least read
Bar heights use a square-root scale. Only the 120 most-read articles are drawn; the journal has 3,757 in total.
Mint this article as an NFT
Not yet mintedCreate a permanent, verifiable on-chain record of this article on the Scimatic Network. The NFT is held in your Journament account, and you can withdraw it to your own wallet at any time.
5
SUSD
one-off · no wallet required
Abstract
The 21st century has seen data emerge as the new oil. The significance of information in making management decisions has increased, making it essential to ensure that it retains the fundamental features of confidentiality, integrity, and availability. Most organizations believe that information security is a technological issue that can be resolved through technology alone. However, it is a comprehensive process that requires risk management, and developing an information security policy is the primary step toward mitigating such risks. This study aims to help a government agency protect its IT services against cyber attacks by developing Issue-specific policies (ISSPs) and a compliance roadmap based on the ISO 27001:2013 standard. The study used the Capability Maturity Model for Integration (CMMI) to conduct a gap analysis and a high-level risk assessment to identify the risks that are the basis of the policies developed. Data triangulation validated the conducted interviews, observations, and analysis of presented documents. The project developed twelve (12) ISSPs to mitigate the seven (7) high risks identified, and the policies' applicability, scope, purpose, penalties, effectiveness, coherence, and completeness were assessed through an expert review. The project concludes by providing the compliance roadmap of the agency to ISO 27001:2013 certification based on the standard's Plan-Do-Check-Act (PDCA) cycle. The author recommends completing policies for medium and low risks, implementing policies, and following the compliance roadmap for future work. It also recommends conducting a detailed risk assessment, creating an enterprise information security policy (EISP), and engaging with an accredited certification body for an external audit to achieve ISO 27001 certification.
Keywords: Information Security, ISO 27001:2013, Issue-specific security policies, gap analysis, high-level risk assessment, compliance roadmap
| Reference Key |
persistent_1760655871_68f179ffd29fe
Use this key to autocite in the manuscript while using
SciMatic Manuscript Manager or Thesis Manager
|
|---|---|
| Authors | Buenaventura, Justin J. |
| Journal | Malay Journal |
| Year | 2023 |
| DOI |
DOI not found
|
| URL | |
| Keywords | Keywords not found |
Citations
No citations found. To add a citation, contact the admin at info@scimatic.org
Comments
No comments yet. Be the first to comment on this article.