S2 - 02 - Information Security Management Practice

Information Security Management Practice — Purpose

The practice of protecting an organization by understanding and managing risks to the confidentiality, integrity, and availability of information (CIA)

Information Security Management Practice — How to Establish

Policies, processes, behaviours, risk management, and controls in relation to authentication, authorization, encryption, and non­ repudiation

• Must be driven from the top-down

True

• E.g. can’t do continual improvement or e.g. incident management unless it’s in line with info sec management

True or False: The Information Security Management Practice interacts with every other ITIL Practice

True

True or False: Information Security Management Practice is not about doing or implementing, it’s more about the policies and RULES you follow while doing something