1 – Information Security Governance
- Developing an information security strategy
- Aligning the information security strategy with corporate governance
- Identifying legal and regulatory requirements
- Justifying investment in information security
- Identifying internal and external influences on the organization
- Obtaining senior management commitment for information security
- Defining roles and responsibilities for information security
- Establishing reporting and communication channels
2 – Information Risk Management
- Implementing an information risk assessment process
- Determining information asset classification and ownership
- Conducting ongoing threat and vulnerability assessments
- Conducting periodic BIAs
- Identifying and evaluating risk mitigation strategies
- Integrating risk management into business life cycle processes
- Reporting changes in information risk
3 – Information Security Programme Development
- Developing plans to implement an information security strategy
- Security technologies and controls
- Specifying information security programme activities
- Coordinating information security programmes with business assurance functions
- Identifying resources needed to implement the information security programme
- Developing information security architectures
- Developing information security policies
- Developing information security awareness, training and education programmes
- Developing supporting documentation for information security policies
4 – Information Security Programme Implementation
- Integrating information security requirements into organizational processes
- Integrating information security controls into contracts
- Creating metrics to evaluate the information security programme
5 – Information Security Programme Management
- Managing information security programme resources
- Enforcing compliance with policies and standards
- Enforcing contractual information security controls
- Enforcing information security during systems development
- Maintaining information security within an organization
- Providing information security advice and guidance
- Providing information security awareness and training
- Analysing the effectiveness of information security controls
- Resolving compliance issues
6 – Incident Management and Response
- Developing an information security incident response plan
- Establishing an escalation process
- Developing a communication process
- Integrating an IRP
- Developing IRTs
- Testing an IRP
- Managing responses to information security incidents
- Conducting investigations into information security incidents
- Conducting post-incident reviews
