基于ISO/IEC标准的信息安全管理关键成功要素组态分析

Configuration Analysis of Key Success Factors of Information Security Management Based on ISO/IEC Standard

基于ISO/IEC系列标准文件,运用模糊集定性比较分析法,探讨包含信息安全制度、高管支持、一致性、信息安全风险评估、信息安全意识、信息安全文化在内的多重因素集合影响组织信息安全管理绩效的协同机制。研究结果表明,能够确保组织高信息安全管理绩效的两种组态分别是高信息安全意识、高水平信息安全文化氛围和高质量信息安全制度、完善的信息安全风险评估,存在一条组织非高信息安全管理绩效的驱动路径。组织可根据组态结果整合内部资源,开展高效信息安全管理。

Based on the ISO/IEC series of standard documents,the fuzzy set qualitative comparative analysis method was applied to explore the synergistic mechanism of multiple factor sets including information security policy,top management,alignment,information security risk assessment,information security awareness,and information security culture that affect the information security management performance.The results show that two types of configuration can improve high information security management performance:strong information security awareness and high-level information security culture,high-quality information security policy and complete information security risk assessment.There exists a driving path for information security management which is non-high performance.The organization can carry out efficient information security management by integrating internal resources in accordance with the configuration results.