A01 chaf6542 06 se fm indd

Information security 

management 

system

An organisational process 

to protect information 

assets.

Information security 

policy

A definition of the 

organisational 

approaches to 

information security and 

the responsibilities of 

employees in protecting 

information.

Information asset 

register (IAR)

A repository for the types, 

value and ownership of 

all information within an 

organisation.

M11_CHAF6542_06_SE_C11.indd   576

7/23/14   1:27 PM

---

577

Chapter 11  Analysis and design

● 

Section 8: System development and maintenance. This specifies how new systems must be 

designed and procured with security in mind.

● 

Section  9: Business continuity management. 

Business continuity management or 

 disaster  recovery

 specifies how the organisation will be able to continue to function in 

the event of a major event such as a fire or flood or other damage to information systems. 

Use of  off-  site  back-  ups and alternative systems is key to this.

● 

Section 10: Compliance. This specifies how an organisation will comply with the rel-

evant UK and EU law related to information security management. Implementing BS 

7799 is a good way of helping ensure that a business does comply with these require-

ments. Regular audit and review needs to occur to ensure the organisation remains 

compliant.

We will now cover some of the main threats to security in the digital business which need to 

be managed.