An Analysis of IS Security Policy Evaluation

Information System security evaluation research usually focuses on the evaluation of how well information systems are secured in relation to a security policy statement or security plan. Most studies concentrate on standards of security measurement such as the “orange book”, or the European standard (ITSEC). Little research however, concentrates on the manner in which security plans (or policies) are developed, and none, to the author’s knowledge, attempt to evaluate the process of generating a security plan, or to evaluate the security plans themselves. This paper is work in progress that discusses the security policy evaluation process.