ITM 825 Ch 1 - ISMS and Security Controls

ISMS

Information Security Management System

Information Security Management System (ISMS)

A system for managing information security risks

Security Control

A management, operational, or technical countermeasure protecting information and systems

Certification

Written assurance from an independent body that specified requirements have been met.

Purpose of the SGP categories

Its categories include security governance, information risk assessment, security management, people management, information management, system access, and threat and incident management, among others.

The five NIST framework functions

Identify, Protect, Detect, Respond, Recover

Identify

Understand the organization’s assets, system, and cybersecurity risks

Protect

Implement safeguards to reduce the impact of potential cybersecurity incidents

Detect

Discover cybersecurity events when they occur

Respond

Take appropriate action following a detected incident

Recover

Restore capabilities and services affected by an incident

CIS Controls

Describes an important security measure

CIS Sub Controls

describe specific actions for implementing, automating, or measuring that control

COBIT 5 IT governance and management

EDM, APO, BAI, DSS, MEA

PCI DSS 6 Goals

1. Build and maintain secure networks and systems.

2. Protect cardholder data.

3. Maintain a vulnerability management program.

4. Implement strong access control measures.

5. Regularly monitor and test networks.

6. Maintain an information security policy.

NIST Implementation Tiers

Partial, Risk Informed, Repeatable, Adaptive

Partial

Risk management is limited or ad hoc.

Risk Informed

Risk management practices are approved but may not be established across the organization.

Repeatable

Formal, regularly applied risk management practices.

Adaptive

Practices adapt to lessons learned and changing threats