Information security management - a practical approach

Information security is an important issue in today´s business. Information security management can no more be done by merely a set of hardware and software. Rather, it requires a complete end-to-end system. Such a system is called Information Security Management System (ISMS). It requires special focus and participation from all levels of employees with full commitments and responsibilities in establishing such a system and implementing it within the organization. ISO security standards and government compliance regulations guide and enforce organizations about certain requirements and norms. Organizations need to build an ISMS by combining all the bits and pieces as per their business needs. This paper illustrates a practical approach, as a ready reference, to build an ISMS in a business organization.