Applying ISO 17799:2005 in information security management

Abstract

In this paper, we discussed ISO 17799:2005 control, process, and security organisation structure. According to the results, the code of practice for information security management includes: capture the processes for implementing information security management in organisational Information Security Management System (ISMS), provide an organisational security structure to assess the extent information security management efforts, provide a comprehensive framework for ensuring the effectiveness of information security control over the information sources that support operations and assets. A case example (National Tax Administration Southern Taiwan Province) of an organisational security management, including organisational security structure, ISMS plan-do-check-act cycle, and information asset assessment management are discussed.