for Information Security
msinghTypewritten TextPREVIEW VERSION
The following pages provide a preview of the information contained in COBIT 5 for Information Security. The publication provides guidance to help IT and Security professionals understand, utilize, implement and direct important information-security related activities and make more informed decisions. COBIT 5 for Information Security is a major strategic evolution of COBIT 5the only business framework for the governance and management of enterprise IT. This evolutionary version incorporates the latest thinking in enterprise governance and management techniques, and provides globally accepted principles, practices, analytical tools and models to help increase the trust in, and value from, information systems. To purchase COBIT 5 for Information Security, visit www.isaca.org/cobit5info-sec Not a member? Learn the value of ISACA membership. Additional information is available at www.isaca.org/membervalue.
http://www.isaca.org/cobit5info-sechttp://www.isaca.org/membervalue
2
for InformatIon SecurIty
ISACA
With more than 100,000 constituents in 180 countries, ISACA (www.isaca.org) is a leading global provider of knowledge, certifications, community, advocacy and education on information systems (IS) assurance and security, enterprise governance and management of IT, and IT-related risk and compliance. Founded in 1969, the nonprofit, independent ISACA hosts international conferences, publishes the ISACA Journal, and develops international IS auditing and control standards, which help its constituents ensure trust in, and value from, information systems. It also advances and attests IT skills and knowledge through the globally respected Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in the Governance of Enterprise IT (CGEIT) and Certified in Risk and Information Systems ControlTM (CRISCTM) designations.
ISACA continually updates and expands the practical guidance and product family based on the COBIT framework. COBIT helps IT professionals and enterprise leaders fulfill their IT governance and management responsibilities, particularly in the areas of assurance, security, risk and control, and deliver value to the business.
DisclaimerISACA has designed this publication, COBIT 5 for Information Security (the Work), primarily as an educational resource for security professionals. ISACA makes no claim that use of any of the Work will assure a successful outcome. The Work should not be considered inclusive of all proper information, procedures and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific information, procedure or test, security professionals should apply their own professional judgement to the specific circumstances presented by the particular systems or information technology environment.
Copyright 2012 ISACA. All rights reserved. For usage guidelines, see www.isaca.org/COBITuse.
ISACA3701 Algonquin Road, Suite 1010Rolling Meadows, IL 60008 USAPhone: +1.847.253.1545Fax: +1.847.253.1443Email: [email protected] site: www.isaca.org
Feedback: www.isaca.org/cobitParticipate in the ISACA Knowledge Center: www.isaca.org/knowledge-centerFollow ISACA on Twitter: https://twitter.com/ISACANewsJoin the COBIT conversation on Twitter: #COBITJoin ISACA on LinkedIn: ISACA (Official), http://linkd.in/ISACAOfficialLike ISACA on Facebook: www.facebook.com/ISACAHQ
COBIT 5 for Information SecurityISBN 978-1-60420-255-7Printed in the United States of America1
Table of ConTenTs
7
tAble of contentsList of Figures ...................................................................................................................................................................................11
Executive Summary..........................................................................................................................................................................13Introduction ....................................................................................................................................................................................13Drivers ............................................................................................................................................................................................13Benefits ..........................................................................................................................................................................................15Target Audience .............................................................................................................................................................................16Conventions Used and Overview ..................................................................................................................................................16
Section I. Information Security ............................................................................................................................................19Chapter 1. Information Security Defined ......................................................................................................................................19
Chapter 2. COBIT 5 Principles ......................................................................................................................................................212.1 Overview ..................................................................................................................................................................................212.2 Principle 1. Meeting Stakeholder Needs .................................................................................................................................212.3 Principle 2. Covering the Enterprise End-to-end ....................................................................................................................222.4 Principle 3. Applying a Single, Integrated Framework ...........................................................................................................222.5 Principle 4. Enabling a Holistic Approach ..............................................................................................................................232.6 Principle 5. Separating Governance From Management ........................................................................................................23
Section II. Using COBIT 5 Enablers for Implementing Information Security in Practice .......................25Chapter 1. Introduction ...................................................................................................................................................................25
1.1 The Generic Enabler Model .....................................................................................................................................................251.2 Enabler Performance Management .........................................................................................................................................261.3 COBIT 5 for Information Security and Enablers .....................................................................................................................26
Chapter 2. Enabler: Principles, Policies and Frameworks .........................................................................................................272.1 Principles, Policies and Framework Model .............................................................................................................................272.2 Information Security Principles ...............................................................................................................................................292.3 Information Security Policies ..................................................................................................................................................292.4 Adapting Policies to the Enterprises Environment .................................................................................................................302.5 Policy Life Cycle .....................................................................................................................................................................31
Chapter 3. Enabler: Processes ........................................................................................................................................................333.1 The Process Model ...................................................................................................................................................................333.2 Governance and Management Processes ................................................................................................................................343.3 Information Security Governance and Management Processes .............................................................................................343.4 Linking Processes to Other Enablers .......................................................................................................................................35
Chapter 4. Enabler: Organisational Structures ...........................................................................................................................374.1 Organisational Structures Model .............................................................................................................................................374.2 Information Security Roles and Structures ..........................................................
