信息安全管理缺口模式及弥补建议

A Gap Model of Information Security Management and Avoiding Suggestions

在信息安全建设过程中,企业的信息安全需求、信息安全保障能力以及企业内部人员认知相互之间存在差异,从而形成信息安全管理知识缺口,造成企业进行信息安全建设后所得成效与预期不一致的情况,据此提出信息安全管理缺口模式并对模型所定义的六个缺口进行分析,最后提出弥补缺口的建议。

The contradictions between information security requirements and capability as well as the staff＇s knowledge and attitude to information security in an enterprise result in the knowledge gaps of information security management,which brings about the inconsistency between expectations and results.Accordingly,the authors propose a gap model for information security management and analyze the six gaps defined in the model.At last,some suggestions for avoiding the gaps are presented.