New Study Shows 38 Percent of Information Security Processes are Immature

The 2007 ISO 27001 Benchmark Study shows many organizations have gaps in their governance of information security.

Fairlawn, Ohio (PRWEB) January 31, 2008 -- New research from Wolcott Group (www.wolcottgroup.com), "The 2007 ISO 27001 Benchmark Study," shows that many organizations have significant gaps in how they manage information security. While most organizations have mature or developing controls for information security, many still have immature processes for key issues like security policy training, access control, asset management, business continuity, IT compliance auditing, and more.

Process Maturity Scorecard

One of the most significant findings from the study is that nearly half of the respondents rated their organization's approach to managing information security as 'initial' or 'non-existent'

"One of the most significant findings from the study is that nearly half of the respondents rated their organization's approach to managing information security as 'initial' or 'non-existent'," stated Gary Sheehan, CISSP, HISP, managing consultant for information security at Wolcott Group. "Essentially, this study demonstrates the need for organizations to adopt a more holistic approach to managing information security like ISO 27001/27002."

Highlights of Immature Controls and Processes:

• 57% have immature processes for classifying the value of their information assets
• 56% have immature employee training programs on information security policies and procedures
• 47% have an immature approach to managing information security
• 45% have immature business continuity processes
• 36% have immature IT compliance auditing processes

Interested parties can visit Download The 2007 ISO 27001 Benchmark Study to register to download a complimentary copy of the benchmark study.

A related webinar
On February 27, 2008, Wolcott Group will host a webinar to expand on the study's findings as well as cover some best practices for managing information security using the ISO 27001/27002 framework. For more information and to register for the webinar, please visit Register for the ISO 27001 Webinar.

The related Online ISO 27001 Self-Assessment is still available
The online ISO 27001 self-assessment that was used to collect the data for the benchmark study is still open for use at Take the ISO 27001 Online Self-Assessment. The self-assessment enables organizations to benchmark their information security practices against the ISO 27001 standard and their peers.

About Wolcott Group
Wolcott Group is one of the top U.S. firms for standards-based, information security training, consulting, and technology solutions. Wolcott Group is a member of the IT Governance Institute, an authorized training center for the Holistic Information Security Practitioner (HISP) certification, and an authorized BSi Management Systems' Associate Consultant for training and consulting on ISO 27001/27002. Wolcott Group is an IBM Premier Business Partner, a Microsoft Gold Certified Partner, and also partners with other information security technology vendors to help its clients to improve their information security practices. For more information, please visit Wolcott Group's web site.

# # #

Post Comment:
Trackback URL: http://www.prweb.com/pingpr.php/Q291cC1QaWdnLVN1bW0tQ291cC1aZXRhLVplcm8=

iso 27001 iso 27002 information security benchmark study research self-assessment security management

Bookmark -  Del.icio.us | Digg | Furl It | Spurl | RawSugar | Simpy | Shadows | Blink It | My Web