Professional Documents
Culture Documents
What:
The IT Governance Institute (ITGI) was established in 1998 to advance international thinking and
standards in directing and controlling an enterprise’s information technology. Effective IT
governance helps ensure that IT supports business goals, optimizes business investment in IT,
and appropriately manages IT-related risks and opportunities. The IT Governance Institute offers
symposia, original research and case studies to assist enterprise leaders and boards of directors in
their IT governance responsibilities.
www.itgi.org
Activities
Sponsors high-level conferences and symposia around the world.
Offers as an open standard (www.isaca.org/cobit) Control Objectives for Information and related
Technology (COBIT®), a breakthrough IT governance tool that uses nontechnical language to help
organizations focus their information technology in support of overall business objectives.
Conducts original research and publishes guidance to help boards of directors, executives and
management understand their changing roles and implement effective IT governance.
Offers case studies on how leading global organizations are implementing IT governance
programs and activities.
Offers the IT Governance Business Game, a day-long training session.
Hosts the IT governance listserv for professionals to share experience.
What:
The Information Systems Audit and Control Association® (ISACA®) is the leading association of
professionals in information systems (IS) audit, control, security and governance. ISACA has a
global membership of more than 35,000 in 100 countries in Asia, Central America, South America,
Europe, Africa, North America and Oceania. Founded in 1969 as the EDP Auditors Association,
ISACA is a global leader in IT governance, security, control and assurance. It is the single leading
international source for information technology controls. ISACA is dedicated to serving the needs of
www.isaca.org its members, who are internal and external auditors, CEOs, CFOs, CIOs, educators, information
security and control professionals, students and IT consultants.
Activities
Offers the Certified Information Systems AuditorTM (CISA®) designation—a globally respected
designation for experienced IS audit, control and security professionals earned by more than
35,000 professionals worldwide since inception.
Offers the Certified Information Security Manager® (CISM®) designation—a globally respected
designation designed for leaders who manage an organization’s information security. Five
thousand people earned the CISM designation within the first two years of its introduction.
Sponsors technical and management conferences on five continents to ensure consistent global
professional education.
Publishes the Information Systems Control Journal, research and technical professional
development material.
Advances globally applicable information systems (IS) auditing standards in addition to
associated guidelines and procedures.
Develops professional resources and networking opportunities through more than 170 local
chapters in support of its members
The ITGI’s leading research publication is Control Objectives for Information and related
Technology (COBIT®). COBIT is fast becoming the most popular and internationally
accepted set of guidance materials for IT governance. The success of COBIT has resulted
in the creation of a growing family of publications and products designed to assist in the
implementation of effective IT governance throughout your enterprise.
The Advantages of COBIT provides significant advantages to those who recognize the need for internal
COBIT provides significant advantages to those who recognize the need for internal control over their information and
the systems that manage it, including:
It is increasingly accepted internationally, based on the professional and practical experiences of experts worldwide.
It is 100 percent compliant with ISO17799, COSO I and COSO II, and maps onto many other related standards.
COBIT is a way to bridge the communication gap between IT functions, the business and auditors, by providing a
common approach, understandable by all.
COBIT is management-oriented, actionable and easy to use.
COBIT provides strong support for IT audit, reduces the cost of audit risk assessment, and enables a higher quality
of audit and related opinion.
COBIT avoids reinventing wheels and shortens the time required to implement effective practices.
COBIT is a flexible and adaptable approach to suit every organization’s unique cultures, size and specific
requirements.
COBIT is complete, objective and continually evolving and is maintained by a reputable not-for-profit organization.
One of the most important assets of an enterprise is its information. The integrity and reliability of
that information and the systems that generate it are crucial to an enterprise’s success. Faced with
complex and correspondingly ingenious cyberthreats, organizations are looking for individuals who
have the proven experience and knowledge to identify, evaluate and recommend solutions to mitigate
IT system vulnerabilities. ISACA offers two certifications to meet these needs.
Certified Information Systems AuditorTM (CISA®) Certified Information Security Manager® (CISM®)
www.isaca.org/cisa www.isaca.org/cism
The CISA program is designed to assess and certify individuals in the CISM is for information security managers and those who have
IS audit, control and security profession who demonstrate information security management responsibilities. It provides
exceptional skill and judgment in information systems audit. executive management with the assurance that those certified have
the expertise to provide effective security management and
The CISA credential measures expertise in the areas of: consulting. It is business-oriented and focused on information risk
• The IS audit process management while addressing management, design and technical
• Management, planning and organization of IS security issues at a conceptual level.
• Technical infrastructure and operational practices
• Protection of information assets The CISM credential measures expertise in the areas of:
• Disaster recovery and business continuity • Information security governance
• Business application system development, acquisition, • Risk management
implementation and maintenance • Information security program(me) development
• Business process evaluation and risk management • Information security management
• Response management
To earn the CISA designation, candidates are required to:
• Successfully complete the CISA examination* To earn the CISM designation, information security professionals
• Adhere to the Information Systems Audit and Control Association are required to:
(ISACA) Code of Professional Ethics • Successfully complete the CISM examination*
• Submit verified evidence of five years of professional information • Adhere to the Information Systems Audit and Control Association
systems auditing, control or security work experience (ISACA) Code of Professional Ethics
(experience substitutions are available) • Submit verified evidence of five years of information security
• Comply with the CISA continuing education program (after experience, with three years of management experience in the
becoming certified) job practice areas (experience substitutions are available)
• Comply with the CISM continuing education program (after
*Certification exams are offered annually in June.
becoming certified)
For more information on becoming a CISA or a CISM, visit the ISACA web site at www.isaca.org/certification.
> > > > > GLOBAL CONFERENCES AND EDUCATIONAL EVENTS
ISACA offers a full spectrum of technical and managerial conferences and education programs that
are sure to meet your professional development needs. Whether you are just starting out as an IS
audit, control or security professional, or are a seasoned executive, these events cover the topics and
issues important to you and are presented by leading experts from around the world. No matter what
your education needs, ISACA has a program that is right for you. For a complete listing of and the
latest information on future conferences and educational events, please visit our web site at
www.isaca.org/conferences.
www.isaca.org/conferences
TO HELP PROFESSIONALS KEEP PACE WITH THE EVER CHANGING IT ENVIRONMENT
RECENT ITGI RESEARCH PROJECTS
➤ COBIT and COBIT Related Products
▪ COBIT Online
▪ Control Practices
▪ COBIT Security Baseline
➤ Security, Audit and Control Projects
▪ Managing Enterprise Information Integrity: Security, Control and Audit Issues
▪ Security, Audit and Control Features PeopleSoft
▪ Security, Audit and Control Features Oracle Applications
▪ Oracle Database Security, Audit and Control Features
▪ OS/390-z/OS Security, Audit and Control Features
➤ Sarbanes-Oxley Projects
▪ IT Control Objectives for Sarbanes-Oxley
▪ Sarbanes-Oxley: A Focus on IT Controls—Symposium CD-ROM
➤ IT Global Status Report
➤ Enterprise Identity Management
ON THE HORIZON
➤ Linux
➤ Cybercrime
➤ Wireless Communication
ITGI books are listed in the online bookstore under the category Published by ISACA & ITGI.
For additional information on these publications and others offered through the bookstore,
please visit us at www.isaca.org/bookstore
For information on research on the horizon see www.isaca.org/research
Please complete both sides
MEMBERSHIP APPLICATION U.S. Federal I.D. No. 23-7067291
Join online and save US $20.00 www.isaca.org
www.isaca.org/join membership@isaca.org
Please note: Membership in the Association requires you to belong to a local chapter when you live or work within 50 miles/80 km of its territory. The name of the
chapter is indicative of its territory. If you live further than 50 miles from the chapter territory, select member at large. This selection is subject to verification
by ISACA international. Cities listed in parentheses are a reference to where the majority of chapter meetings are held. Please contact your local chapter at
www.isaca.org/chapters for other meeting locations.
Current field of employment (check one) Level of education achieved Work experience
1 ■ Financial (indicate degree achieved, or number of years of (check the number of years of Information
2 ■ Banking university education if degree not obtained) Systems work experience)
3 ■ Insurance 1■ One year or less 7 ■ AS 1 ■ No experience 4 ■ 8-9 years
4 ■ Transportation 2■ Two years 8■ BS/BA 2 ■ 1-3 years 5 ■ 10-13 years
5 ■ Retail & Wholesale 3■ Three years 9■ MS/MBA/Masters 3 ■ 4-7 years 6 ■ 14 years or more
6 ■ Government/National 4■ Four years 10 ■ Ph.D.
7 ■ Government/State/Local 5■ Five years 99 ■ Other Current professional activity (check one)
8 ■ Consulting 6■ Six years or more 1
______________ ■ CEO
9 ■ Education/Student 2 ■ CFO
10 ■ Education/Instructor Certifications obtained 3 ■ CIO/IS Director
11 ■ Public Accounting (other than CISA/CISM) 4 ■ Audit Director/General Auditor
12 ■ Manufacturing 1 ■ CPA 7 ■ CFE 5 ■ IS Security Director
13 ■ Mining/Construction/Petroleum 2 ■ CA 8 ■ MA 6 ■ IS Audit Manager
14 ■ Utilities 3 ■ CIA 9 ■ FCPA 7 ■ IS Security Manager
15 ■ Other Service Industry 4 ■ CBA 10 ■ CFSA 8 ■ IS Manager
16 ■ Law 5 ■ CCP 11 ■ CISSP 9 ■ IS Auditor
17 ■ Health Care 6 ■ CSP 99 ■ Other __________ 10 ■ External Audit Partner/Manager
99 ■ Other 7 ■ FCA 11 ■ External Auditor
12 ■ Internal Auditor
Date of Birth________________________ 13 ■ IS Security Staff
MONTH/DAY/YEAR 14 ■ IS Consultant
15 ■ IS Vendor/Supplier
16 ■ IS Educator/Student
99 ■ Other ____________________________
Payment due By applying for membership in the Information Systems Audit and Control
• Association dues ✝ $ 120.00 (US) Association, members agree to hold the Association and its chapters, and the IT
• Chapter dues (see reverse) $ _____ (US) Governance Institute, and their respective officers, directors, members, trustees,
• New member processing fee $ 30.00 (US)* employees and agents, harmless for all acts or failures to act while carrying out the
purposes of the Association and the Institute as set forth in their respective bylaws,
PLEASE PAY THIS TOTAL $ _____ (US) and they certify that they will abide by the Association's Code of Professional Ethics
✝ For student membership information please visit www.isaca.org/student (www.isaca.org/ethics).
* Membership dues consist of association dues, chapter dues and new member Initial payment entitles new members to membership beginning the first day of the
processing fee. Join online and save US $20.00. month following the date payment is received by International Headquarters
through the end of that year.
Method of payment
No rebate of dues is available upon early resignation of membership.
■ Check payable in US dollars, drawn on US bank
■ Send invoice (Applications cannot be processed until dues payment is received.) Contributions, dues or gifts to the Information Systems Audit and Control
■ MasterCard ■ VISA ■ American Express ■ Diners Club Association are not tax deductible as charitable contributions in the United
States. However, they may be tax deductible as ordinary and necessary
All payments by credit card will be processed in US dollars business expenses.
ACCT # ____________________________________________ Make checks payable to:
Information Systems Audit and Control Association
Print name of cardholder _______________________________
Mail your application and check to:
Expiration date _______________________________________ Information Systems Audit and Control Association
MONTH/YEAR 1055 Paysphere Circle
Signature ___________________________________________ Chicago, IL 60674 USA
Phone: +1.847.253.1545 x475
Cardholder billing address if different than address provided above: Fax: +1.847.253.1443
___________________________________________________
___________________________________________________
US dollar amounts listed below are for local chapter dues. For current chapter dues, or if the amount is not listed below, please
While correct at the time of printing, chapter dues are subject to visit the web site www.isaca.org/chapdues or contact your local
change without notice. Please include the appropriate chapter dues chapter at www.isaca.org/chapters.
amount with your remittance.
“ Directors have a responsibility to protect shareholder value. This responsibility applies just as
stringently to valued information assets as it does to any other asset. Boards must recognise that
securing that information is not just an investment; it is essential for survival in all cases and for
many it can even create competitive advantage.
”
— RONALD SAULL, CHIEF INFORMATION OFFICER AND SENIOR VICE PRESIDENT,
GREAT-WEST LIFE ASSURANCE COMPANY/LONDON LIFE/INVESTORS GROUP
“ IT security provides the management processes, technology and assurance to allow business
management to ensure business transactions can be trusted; ensure IT services are usable
and can appropriately resist and recover from failures due to error, deliberate attacks or
disaster; and ensure critical confidential information is withheld from those who should not
”
have access to it.
International Federation
of Accountants
Japanese Institute of
Certified Public Accountants
The IBM logo is a registered trademark of IBM in the United States and other countries and used under license.
IBM responsibility is limited to IBM products and services and is governed solely by the agreements under which
such products and services and provided.
IT Governance Institute 3
Acknowledgements
The IT Governance Institute wishes to recognise:
Table of Contents
PURPOSE AND STRUCTURE OF DOCUMENT ...................................6
INFORMATION SECURITY GOVERNANCE: GUIDANCE FOR
BOARDS OF DIRECTORS AND EXECUTIVE MANAGEMENT
1. THE BACKGROUND TO INFORMATION
SECURITY GOVERNANCE...................................................................8
2. WHAT IS INFORMATION SECURITY?...............................................8
3. WHY IS INFORMATION SECURITY IMPORTANT? ......................11
4. WHO SHOULD BE CONCERNED WITH
INFORMATION SECURITY GOVERNANCE?..................................11
5. WHAT SHOULD THE BOARD AND MANAGEMENT DO?...........12
6. WHAT ARE SOME THOUGHT-PROVOKING
QUESTIONS TO ASK?..........................................................................14
7. WHAT SHOULD INFORMATION SECURITY
GOVERNANCE DELIVER? .................................................................16
8. WHAT CAN BE DONE TO SUCCESSFULLY
IMPLEMENT INFORMATION SECURITY GOVERNANCE?.........16
9. HOW DOES MY ORGANISATION COMPARE?...............................21
10. WHAT DO REGULATORY AND STANDARDS BODIES SAY?......24
REFERENCES ............................................................................................28
6 Information Security Governance
Guidance for Boards of Directors and Executive Management
However, the days of issuing a policy, educating users and then expecting
“The emerging that everyone will comply are gone. The speed with which risks emerge and
approach to the rate of change require a different and continuous approach, referred to
information as “test and patch.” It implies continuous monitoring and testing of the
security is not infrastructure and environment for vulnerabilities and the required response
unlike the guard in terms of security fixes through the security management function,
improved defences and changed policies, as illustrated below.
walking the
corridors at night
and testing the 3 Perform
Active
door handles.” Monitoring
5 Security
Management
IT Governance Institute 11
This means that there are new risk areas that could have a significant
impact on critical business operations, such as:
• Increasing requirements for availability and robustness
• Growing potential for misuse and abuse of information systems
affecting privacy and ethical values
• External dangers from hackers, leading to denial-of-service and virus
attacks, extortion and leakage of corporate information
1
See Board Briefing on IT Governance, also published by the IT Governance Institute.
IT Governance Institute 13
For too long, information security was seen as a negative factor, creating
value through nonoccurrence. However, as a result of global networking
and extending the enterprise beyond its traditional boundaries, it is
emerging as a value creator and opportunity builder in its own right, in
particular through the instilling of trust among IT stakeholders.
2
The key words highlighted in this sub-section refer to the International Federation of
Accountants’ statement on Managing Security of Information, described in Section 2.
14 Information Security Governance
Guidance for Boards of Directors and Executive Management
• Does anyone know how many people are using the organisation’s
systems? Does anybody care whether they are allowed or not, or what
they are doing?
• Is security considered an afterthought or a prerequisite?
• What would be the consequences of a serious security incident in terms
of lost revenues, lost customers and investor confidence?
Strategic Alignment
• Security requirements driven by enterprise requirements
• Security solutions fit for enterprise processes
• Investment in information security aligned with the enterprise strategy
and agreed-upon risk profile
Value Delivery
• A standard set of security practices, i.e., baseline security following best
practices
• Properly prioritised and distributed effort to areas with greatest impact
and business benefit
• Institutionalised and commoditised solutions
• Complete solutions, covering organisation and process as well as
technology
• A continuous improvement culture
Risk Management
• Agreed-upon risk profile
• Understanding of risk exposure
• Awareness of risk management priorities
Performance Measurement
• Defined set of metrics
• Measurement process with feedback on progress made
• Independent assurance
• What are the top three critical information assets of the enterprise?
What confidence does managment have regarding information
availability, confidentiality and integrity over these critical information
assets?
• Does management know where the enterprise is most vulnerable within
the IT infrastructure?
• Can the entity continue to operate if the critical information is
unavailable, compromised or lost? What would be the consequences
of a security incident in terms of lost revenues, lost customers and
investor confidence? What would be the consequences if the
infrastructure became inoperable?
• What are the information assets subject to laws and regulations? What
has management instituted to assure compliance with them?
• Does the information security policy address the concern of the board
and management on information security (“tone at the top”), cover
identified risks, establish an appropriate infrastructure to manage and
control the risks, and establish appropriate monitoring and feedback
procedures?
• Has the organisation ever had its network security checked by a
third party?
• Does the organisation provide information security awareness training to
all and is security part of staff and management’s appraisals?
• Is management confident that security is being adequately addressed in
the company?
There are some fundamental steps boards and management can take to
ensure that effective information security governance is implemented in
their enterprise. Those steps are:
Adopt Best Practices
At the Board of Director Level
• Establish ownership for security and continuity with enterprise
managers.
• Create an audit committee that clearly understands its role in informa-
tion security and how it will work with management and auditors.
• Ensure that internal and external auditors agree with the audit commit-
tee and management how information security should be covered in the
audit.
• Require that the head of security report progress and issues to the audit
committee.
• Develop crisis management practices, involving executive management
and the board of directors from pre-agreed thresholds onward.
Non-
Existent Initial Repeatable Defined Managed Optimised
0 1 2 3 4 5
Maturity Description
Level
Non-Existent
• Risk assessment for processes and business decisions does not
occur. The organisation does not consider the business impacts
associated with security vulnerabilities and with development
project uncertainties. Risk management has not been identified as
relevant to acquiring IT solutions and delivering IT services.
• The organisation does not recognise the need for IT security.
0 Responsibilities and accountabilities are not assigned for ensuring
security. Measures supporting the management of IT security are
not implemented. There is no IT security reporting and no response
process to IT security breaches. There is a complete lack of a
recognisable system security administration process.
• There is no understanding of the risks, vulnerabilities and threats
to IT operations or the impact of loss of IT services to the business.
Service continuity is not considered as needing management
attention.
22 Information Security Governance
Guidance for Boards of Directors and Executive Management
Maturity Description
Level
Initial/Ad-Hoc
• The organisation considers IT risks in an ad hoc manner, without
following defined processes or policies. Informal assessments of
project risk take place as determined by each project.
• The organisation recognises the need for IT security, but security
1 awareness depends on the individual. IT security is addressed on a
reactive basis and not measured. IT security breaches invoke
“finger pointing” responses if detected, because responsibilities are
unclear. Responses to IT security breaches are unpredictable.
• Responsibilities for continuous service are informal, with limited
authority. Management is becoming aware of the risks related to
and the need for continuous service.
Defined Process
• An organisation-wide risk management policy defines when and
how to conduct risk assessments. Risk assessment follows a
defined process that is documented and available to all staff
through training.
• Security awareness exists and is promoted by management.
3 Security awareness briefings have been standardised and formalised.
IT security procedures are defined and fit into a structure for
security policies and procedures. Responsibilities for IT security are
assigned, but not consistently enforced. An IT security plan exists,
driving risk analysis and security solutions. IT security reporting
is IT-focused, rather than business-focused. Ad hoc intrusion testing
is performed.
• Management communicates consistently the need for continuous
service. High-availability components and system redundancy are
being applied piecemeal. An inventory of critical systems and
components is rigorously maintained.
IT Governance Institute 23
Maturity Description
Level
Managed and Measurable
• The assessment of risk is a standard procedure and exceptions to
following the procedure would be noticed by IT management. It is
likely that IT risk management is a defined management function
with senior level responsibility. Senior management and IT
management have determined the levels of risk that the organisation
will tolerate and have standard measures for risk/return ratios.
• Responsibilities for IT security are clearly assigned, managed and
enforced. IT security risk and impact analysis is consistently per-
formed. Security policies and practices are completed with specific
4 security baselines. Security awareness briefings have become
mandatory. User identification, authentication and authorisation
are standardised. Security certification of staff is established.
Intrusion testing is a standard and formalised process leading to
improvements. Cost/benefit analysis, supporting the implementation
of security measures, is increasingly being utilised. IT security
processes are co-ordinated with the overall organisation security
function. IT security reporting is linked to business objectives.
• Responsibilities and standards for continuous service are enforced.
System redundancy practices, including use of high-availability
components, are consistently deployed.
Optimised
• Risk assessment has developed to the stage where a structured,
organisation-wide process is enforced, followed regularly and
managed well.
• IT security is a joint responsibility of business and IT management
and is integrated with corporate security business objectives. IT
security requirements are clearly defined, optimised and included in
a verified security plan. Security functions are integrated with
applications at the design stage and end users are increasingly
accountable for managing security. IT security reporting provides
early warning of changing and emerging risk, using automated active
5 monitoring approaches for critical systems. Incidents are promptly
addressed with formalised incident response procedures supported by
automated tools. Periodic security assessments evaluate the effective-
ness of implementation of the security plan. Information on new
threats and vulnerabilities is systematically collected and analysed,
and adequate mitigating controls are promptly communicated and
implemented. Intrusion testing, root cause analysis of security
incidents and pro-active identification of risk is the basis for
continuous improvements. Security processes and technologies are
integrated organisation-wide.
• Continuous service plans and business continuity plans are integrated,
aligned and routinely maintained. Buy-in for continuous service
needs is secured from vendors and major suppliers.
24 Information Security Governance
Guidance for Boards of Directors and Executive Management
The more detailed elements of COBIT provide some 300 detailed control
objectives for management and IT practitioners who are looking for best
practices in control implementation, and extensive audit guidelines
building on these objectives. The latter are geared toward those needing
to evaluate and audit the degree of control and governance over IT
processes.
References
IT Governance Institute, COBIT (Control Objectives for Information and
related Technology) 3rd Edition, 2000, www.ITgovernance.org and
www.isaca.org