ABSTRACT
Setting up a security program management process or information security management system is therefore of paramount importance to any decision-maker. Security program management includes steering and supervising the controls in place, operational activities, change projects, planning, and coordination. Program management according to a formalized process is of utmost importance. The key principles advocated by the standard should be taken into account when developing the security program: The security program review cycle as outlined earlier encompasses the ISO 27001 recommendations contained in the Requirements for an Information Security Management System. An easily understandable roadmap that will be reviewed as part of the security program review cycle is one of the main tools of governance. The few steps and tools presented in this chapter can inspire security managers and governing bodies to put similar approaches in place to improve security program management process.
