Organization
are going to be subject to the ISMS and which parts if any are not and
applicability of the ISMS that what does the ISMS apply to and protect -
usually ‘information’ or ‘information assets’.
Scoping
the ISMS is an important business decision, best made by senior managers who
appreciate what the ISMS is all about and understand what it does for the
business. Unfortunately, however, there’s a chicken-and-egg situation here:
before the ISMS is approved, designed and implemented, few senior managers are
likely to have much of a clue about what the ISMS is, let alone how valuable it
will
be so it’s a very good idea to put some time
and effort into explaining things in a way that make business sense. A good
business case for the ISMS, for instance, will describe the approach in general
terms, laying out the anticipated business benefits and the costs, and giving
management various options.
Here’s
a bunch of questions typically of interest to management that you might like to
consider if not explicitly address in the business case and associated
chats, discussions, presentations, project
plans.
• Why do we need ISMS? What will it do
for us? How much will it cost? How long will it take to get going? Will it
consume all our information security resources?
• We’ve managed without ISMS until now:
why the change? What prompted this proposal?
• Isn’t this something that IT should
be doing? What is the relevance to the rest of the organization? Why are you
even asking me to get involved?
• Don’t we have this already?
• How deeply should we get into this?
Can we scrape by with the bare minimum and still reap most of the benefits, or
do we need to make a serious investment and go for broke? What else can we
squeeze out of this opportunity?
• What do other departments, experts,
advisors and influencers think about this? Who else is or should be involved?
Are they all fully engaged with and supportive of the proposal, or might they
be upset if this goes ahead? Can we cope with the changes of power and
relationships that are likely to happen? Do the changes promise to be
beneficial overall?
• Is this something our competitors are
doing? Is there any competitive advantage in doing this? Is it more advantageous
than all the other stuff we could be doing?
• What barriers are there or might
there be, and what can/should we do about them?
• If we decide to go ahead, when is the
best time to do it? What else will be affected? What are the risks associated
with the implementation project?
• Who should run it? What kinds of
skills and competencies do they need? Can we afford to divert them from other
duties onto this? What about the rest of the team?
User questions & answers