I have worked with information security for several years (despite my young age) and I have seen numerous different policies, rules, procedures, and other types of security documentation. What works best is to have a clear, well-defined breakdown between these, for example:

Efficiency and productivity are discussed in many contexts. In information security management, it also makes sense to ensure processes are working effectively. But how do you measure whether your information security is effective and whether it is developing in the right direction?

The Plan-Do-Check-Act (PDCA) process originates from quality assurance in production environments, but has for some years also been a requirement in the ISMS standard ISO 27001 (ISMS = Information Security Management System).

Join us when Founder and CEO Lars Neupart gives a guided tour through ISO 27001, related standards and best practices for information security management. Click below and sign up for one or more half-hour webinars:

The 2022 editions of the widely used standards for information security management, ISO 27001 and 27002 have been updated. The new versions contain a number of improvements that should be of interest to companies that lean towards ISO 27001 or comply with it.

Cloud computing promises many benefits. Cost reductions, improved efficiency and improved security is what many companies can gain from moving into the cloud.

IT outsourcing can be a highly positive experience.

How does the ISO 27001 revision impact your risk management?

It has been eight years since the ISO 27001 standard was last revised but now changes are coming.

Information security standards have at least two characteristics: 1) they can cure most sleep problems and 2) some describe a relatively perfect world where those responsible for information security have plenty of time and where there are enough resources to analyse needs and document decisions. Even though I may have started this post a little sarcastic, I'm actually a big supporter of standards and "best practice"; I see no reason to reinvent good stuff. I cannot do anything about the standards being boring, but I write this post to suggest some responsible shortcuts to a good start on risk assessments and as a pragmatic approach to ISO 27001 compliance (should you want that).