论文部分内容阅读
随着社会的发展,组织业务和IT之间融合紧密。为此ISO组织提出了ISO 27001和ISO 20000等体系用于管理组织的IT应用,但组织内部实施多个体系时容易造成冲突和不一致现象。为此,本文提出将不同体系的具体内容划分为通用和专用部分,对通用部分采用不同形式的融合,对专用部分从服务出发,先识别各服务流程再进行信息安全风险评估和选择安全控制措施,进而构建IT服务体系和信息安全管理体系。
With the development of society, the organization business and IT integration closely. To that end, the ISO organization has proposed systems such as ISO 27001 and ISO 20000 for the management of an organization’s IT applications. Conflicts and inconsistencies can easily result when implementing multiple systems within an organization. Therefore, this paper proposes that the specific content of different systems be divided into general and specific parts, different parts of the general part of the integration of the dedicated part of the service, first identify each service process and then conduct information security risk assessment and selection of safety control measures , And then build IT service system and information security management system.