INFORMATION SECURITY MANAGEMENT SYSTEM - A Case Study in a Brazilian Healthcare Organization

Abstract

ISO 27001 is the international standard for an Information Security Management System (ISMS) that helps to address the triad of information security: Confidentiality, Integrity, and Availability (CIA). An ISMS is a systematic approach focused on managing information security within an organization. It encompasses all the information assets, such as: people, processes and IT systems. This paper describes the implementation process of an ISMS in a Brazilian healthcare organization. We use an information system based on ISO standards as an indicator to assess the information security. Using Chi-square with Yates' correction or Fisher's exact test to compare the proportion of adequacy to the requirements of reference standard used, our case study showed positive results in the first ten months of implementation with significant results on multiple items analysed. However, in an environment of limited budgets, better results were not achieved in the following months due to the financial problems to implement specific controls in the organization. The aim of this paper is to present the experience obtained during the implementation of an ISMS in a healthcare organization and to discuss some critical success factors.

A real-world information security performance assessment using a multidimensional socio-technical approach

“…• the prioritisation of different ISec areas, i.e. a scoring scheme that assigns a value to each control and defines a weight index for different ISec domains [43][44][45];…”