Analysis on the Causal Relationship and Improvement Strategy of Information Security Management with DEMATEL

The study applied Decision Making Trial and Evaluation Laboratory (DEMATEL) to analyze the casual relationship and mutual impact level between the control items of the information security management system. Three core control items of the information security management system are found, Security Policy (SC1), Access Control (SC7) and Human Resources Security (SC4) respectively. They can be provided to enterprises as the direction of continuous improvement, risk reduction and the establishment of competitive advantages. The study applied the methodology value of DEMATEL, which not only has established the causal relationship and mutual impact level between the 11 information security control items, but also provided organizations with the least resource input to resolve practical intricate issues. Keywords-ISO 27001; ISO 27002; cause-effect analysis; decision making trial and evaluation laboratory (DEMATEL); information security management system; continuous improvement