Developing an Information Security and Risk Management Strategy

(ISRM) strategy provides an organization with a road map for information and information infrastructure protection with goals and objectives that ensure capabilities provided are aligned to business goals and the organization’s risk profile. Traditionally, ISRM has been treated as an IT function and included in an organization’s IT strategic planning. As ISRM has evolved into a more critical element of business support activities, it now requires its own independent strategy to ensure its ability to appropriately support business goals and to mature and evolve effectively. A multiphased approach to developing an ISRM strategy is often most effective and provides recognizable results and value to an organization.