Development of an Information Security Management System (ISMS)

 

Requirements on IT and its security

 

The aim of every institution is to ensure business the continuity of business operations strategically as well as with regard to their operational realization. The importance of the security of information as well as the systems with which they are processed increases together with the progression of dependence on information technologies. Business operations without the aid of IT aren't feasible any more nowadays, the impairment, loss or breakdown of IT systems can have disastrous results.

 

Apart from their internal interests in a secure IT, business companies also face diverse external demands:

 

• observance of laws (BDSG, tax laws, Basel II etc.)
• ensuring an adequate quality management
• chartered accountants (checks for regularity)
• requirements of norms for auditings/certifications

 

Problems in Establishing an ISMS

 

For many institutions, the difficulties in enforcing data protection effectively and efficiently mainly lie in establishing a structured approach. The challenge lies in

 

• usefully carrying out analyses,
• preparing concepts, guidelines, documentations etc. and
• realizing them internally.

 

Possibilities for Support through the UIMC

 

UIMC has the competence and experience required, as well as an extensive product portfolio, to aid institutions in developing and realizing information security management systems in any given phase, or to enable institiutions to fulfil the norms and thereby establish an ISMS on their own.

 

All our products are adjusted to each other and based on the internationally acknowledged security standard ISO/IEC 17799 (BS 7799), so that each phase can be carried through according to the norms and no interface problems may arise.

 

The following possibilities for support may serve as examples:

 

1. tool-supported analyses observing the key-note of the process for efficient investigation, evaluation and concept creation


• risk analyses
• IT security strategy and target setting workshops
• IT security weak point analysis


2. standardized means of organization


• IT security manual
• emergency manual
• diverse guidelines and procedures


3. individual consultation, demand-oriented assistance with implementations, training and internal audits


4. solutions suited for specific demands (e. g. low budget concept)

 

Do you wish further information about these issues? Please contact us, and we will gladly explain these possibilities at greater detail – if you wish, in person.