Project of ISMS Implementation in Organization – Aspects and Practical Experiences

Abstract

The Information Security Management System (ISMS) represents one of the most complex management systems for implementation in an organization. The comlexity of this system, based on the standard ISO 27001:2013, is a consequence of specific Annex A of the standard that defines 14 areas of information security, with 35 security objectives and 114 controls. Some of these controls are technical, some organizational and some combined ones. It asks the project of ISMS implementation in the organization to be carefully planned and implemented. In this paper, some project management specific aspects related to implementation of this type of project are considered and some practical experiences of the project of ISMS establishment and further improvement in particular organization are presented.

Keywords

• integrated security management system
• project management
• risk management
• statement of applicability
• general data protection regulation (gdpr)