Chapter 8, Problem 2E

Program Plan Intro

ISO/IEC 27001:

• ISO/IEC 27001 is a specification for an information security management system (ISMS) which is established in 2005 for creating the security practices better and more efficient.
• An information security management system is a framework of rules and events that contains all technical, legal and physical controls involved in company’s information risk management processes.

NIST:

• NIST refers “The National Security Telecommunications and Information system Security Committee” document. This document offers a complete model for information security.
• It mentions the documentation of performance measurements in a regular format to guarantee the repeatability of the measurement collection, development, customization and reporting activities.

Explanation of Solution

Strengths of NIST programs compared to the ISO:

• One of the main strengths of NIST is that there is excess of presence of documentation which can be used to make a forceful information security environment.
• This framework helps in prioritizing the high risks that the organization faces.
• This framework helps an organization to emphasis on actual risks first and concern about not so critical risks later.
• This framework emphases on a risk based method by employing the best practices from already recognized frameworks like COBIT, ISO and many such...