Providing a Model for Selecting Information Security Control Objectives Using Fuzzy Screening Technique with a Case Study

Abstract

Todays, establishing of information security in organizations is inevitable. Implementation of information security in organizations is carried out through the implementation of information security control objectives and controls. Since there are 39 control objectives and 133 controls so implementation of all objectives / controls in terms of scheduling and budget would be difficult and costly for managers and ISMS executives. Organization managers are trying to choice high risk and critical controls among all controls for implementation or improvement. On the other hand previous quantitative methods for ranking areas / objectives / controls, in addition to the mathematical complexity have divergence problem. As well as organization managers and individuals concerned with ISMS have little information about the objectives and controls. Therefore in this paper Fuzzy Screening technique is used for selection of critical controls. In the present study, fuzzy screening process is discussed for selecting and prioritizing of security control objectives.