About the Assessement
Information Security Management System Maturity Level Self-Assessment
Maturity Level of Information Security Management System in Organization. Used methodologies Maturity Levelling ISO/IEC 15504 The Capability Maturity Model, ISO/IEC 21827 Information technology — Security techniques — Systems Security Engineering — Capability Maturity Model® (SSE-CMM®),COBIT, industrial best practices.
Instructions
There are 10 questions.
1. Select the most appropriate option.
2. Your can select only one option for each question
3. Click button to process the assessment
The result of Assessment will indicate Your system level
The levels are:
1. Initial System, this means Culture:- Information Security is accepted as 'necessary evil'. Procedures and policies are paperwork. People:- Small IT team (mainly outsourced) only for basic system administration activities.No reporting in place. Process:- Informal and ad-hoc processes. No process approach implemented. Technology:- Basic security configurations on existing technologies.Decentralized security organization with limited coordination across functions.Focus mainly on prevention.
2. Developing System, this means Culture:- Information Security should be integrated into the business. We understand the necessity of information security. People:- Information Security is mainly IT department function, but general responsibilities and functions regarding information security are defined. Process:- Better coordination of security processes by IT.But processes remain informal, manual and dependent on individuals.Some elements of information security risk assessment is in place. Technology:- More advanced use of security technologies, adoption of tools for vulnerability detection, incident ticketing.
3. Advance/Mature System, this means Culture:- Information Security is part of the culture. People:- Information Security team has some autonomy from IT department.Staff has relevant security competence. Process:- Process approach implemented. Documented and formal information security processes that are regularly monitored and their effectiveness regularly measured.Information Security Risk management process is established and implemented. Technology:- Focus on incident prevention, detection and response. Vulnerability management full cicle has been implemented. Event logging and monitoring process has been introduced.