ISO/IEC 17799: A Methodological Information Management System

During SDLC phase one, the initiation phase, “the need for a system is expressed and the purpose of the system is documented” (NIST, 2008). Some of the expected outcomes from this phase would be a project plan and schedule; system performance specifications outlining the operational requirements, system design documents, and a document that defines roles and responsibilities. The corresponding RMF step, security categorization, establishes the foundation for security standardization among information systems and provides a vital step towards integrating security into the information system (NIST, 2008). During this step, the type(s) of information processed by the information system are identified and the information system is categorized to determine the level of protection requirements to put in place. Some of the expected outputs of this step include a security project plan and schedule, documented system boundary, the system categorization, and the security roles and responsibilities. These two process steps are very similar except the focus of RMF is on information security related functions. In some cases, SDLC produces the expected outputs that RMF requires, and the security professionals only require a copy of the documentation for their records. For example, the system design document often depicts the system boundary. The reason this step is so critical is that it

Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.

“The Federal Information Processing Standards Publication Series of the National Institute of Standards and Technology (NIST) is the official series of publications relating to standards and guidelines adopted and promulgated under the provisions of Section 5131 of the Information Technology Management Reform Act of 1996 (Public Law 104-106) and the Federal Information Security Management Act of 2002 (Public Law 107-347)” ("FIPS PUB 199," 2004). In this paper, FIPS PUB 199 has been chosen as the security standard used by State of Maryland Department of information technology. This standard addresses to develop standards for categorizing information and information systems. On the other hand, ISO/IEC 27001 is the other standard not used by State of Maryland which has been discussed as a contrast standard.

Harris, S. (2006, November 5). Developing an information security program using SABSA, ISO 17799. Retrieved September 19th, 2015, from

Other security elements are in reference to data recovery, database administration, handling a breach in security and administrative security policies such as access procedure, employee transfer and excessive user access. As I assume the role of the chief security officer, database designer, database administrator, and chief applications designer this project is very important to the armed services and the Virgin Islands National Guard as we strive to provide global security.

According to Whitman and Mattord (2010), The ISO 27000 series is one of the most widely referenced security models. Referencing ISO/IEC 27002 (17799:2005), the major process steps include: risk assessment and treatment, security policy, organization of information security, asset management, human resources security, physical and environmental security, communications and operations management, access control, information systems acquisition, development, and maintenance, information security incident management, business continuity management, and compliance

This policy is guided by the ISO/IEC 27002:2013 Information technology - Security techniques -Code of practice for information security controls and sets out our requirements for effectively managing information security in a risk based manner.

• Design of security solutions for information systems and environments of operation including selection of security controls, information

The ISO/IEC 27000-series consist of information security standards published jointly by the International Organization for Standardization (ISO) and the International Electro technical Commission (IEC). In accordance with ISO/IEC 2700, we begin to define the guidelines to support the interpretation and implementation of information

SABSA concentrates on the utilization of "best practices" for any association that needs to create data security arrangements and traceable business undertaking activities. SABSA gives coordinated structures, models, systems, and courses of action that are danger centered and location both dangers and opportunities. The SABSA technique utilizes a "business-driven methodology" comprising of a "six-layer model covering each of the four sections of the IT lifecycle: Strategy, Design, Implementation, and Management & Operations."

CISO stands for chief information Security Officer.CISO play a very vital role in a large companies and enterprise. Generally he handle all the security issue like developing, maintenance and some security related problems that decrease the organisation hazard. He has the highest designation in a company.In other word we can say that he do look after of the security issue. Which will protect the companies highly confidential information.Highly confidential think can be any this like information store in the server, Recipes of item like food, drink and so on. He is also establish the policies and procedure for the employees of the companies. there are some other responsibilities follow by CISO:-

Today, the established way for describing security requirements, as reflected for example in the Common Criteria, an international standard to achieve comparability of independent IT security evaluations, starts with a description of the functional requirements, the system architecture, and its working environment. It then continues with a threat analysis that describes envisaged threats, possibly followed by an evaluation of the severity of threats through a risk analysis and ends with the definition of a security policy.

A security administrator can look to the Information Technology- Code of Practice for Information Security Management, ISO 17799/BS 7799 as well as ISO 17799/BS 7799, the NIST Security Models including the SP 800-12, 14, 18, 26, and 30, and the VISA International Security Model are just a few of the established security frameworks available.

ISACA was established in 1967, by specific commercial ventures operating in the field of frameworks. At that point, in 1969 they were fused as Electronic Data Processing (EDP) Auditors Affiliation. Parts of ISACA cooperated to create and make best practices , and COBIT system is one of their wok. The primary adaptation of this framework was discharged in 1996 and was called "Control Objectives for Information and related Technology",covering the range of review [12]. The second version with upgrades on control evaluation was discharged in 1998 . The third release was discharged after two years, and as indicated by [12] "The huge change accompanied the distribution of COBIT Third Edition, with its business objective introduction. At this point, COBIT was termed as an IT administration skeleton. The third release recognized that an association needs IT for data handling, as well as to accomplish business destinations". In 2005 ISACA presented another , fourth form of COBIT with a reasonable concentrate on IT legislation [14]. A further form of this structure is COBIT 4.1 , discharged in 2007, tolerating the by and large utilized schemas, for example, "IT Infrastructure Library (ITIL)", "ISO 27000 arrangement" and "Ability Maturity Model® Integration (CMMI)" [5], [15]. The current rendition of the structure, COBIT 5, was discharged in 2012. It is based upon the past rendition of the schema and two integral skeletons from ISACA (Val IT and Risk IT); and

ISO 9001 is a Quality management standard which is recognised internationally and used by organizations worldwide. It can be used by business of all sizes, it provides an effective quality management system. It was first published in 1987 (updated 1994, 2000, 2008). The latest version was published in 2015. This replaces all the previous editions. (Praxiom Group 2014)