Information Asset Security Frameworks, Standards, and Guidelines
An information security framework is a set of documented policies, procedures, and processes that define how information is managed in an organization. There are two prime objectives of the framework:
- Lower risk and vulnerability
- Protect the enterprise by guarding the CIA of critical and sensitive information
Auditing the Information Security Management Framework
An IS auditor should consider the following aspects for auditing the information security management framework:
- Review the adequacy and approvals for various policies, procedures, and standards.
- Review security training and awareness programs and procedures. Determine the effectiveness of the program. It is advisable to interact with a few employees and evaluate their level of awareness.
- Determine whether proper ownership has been assigned for critical processes, systems, and data. The IS auditor should determine whether...
