A Business Goal Driven Approach for Understanding and Specifying Information Security Requirements

We present a new approach to explicity link security requirements with the organization’s business vision. A conceptual framework is presented, where the relationships between business vision, critical impact factors and valuable assets (together with their security requirements) are clearly show. Evaluating this relationships and considering also organization’s business drivers, it is possible to define a plan for prioritizing security requirements primary required by organization’s business.