A information security management scheme for enterprise information system

摘要

Information system is an essential resource in modern enterprises, and its security is concerned by the enterprises. Information security management is an effective way to avoid or mitigate risks that may result in security incidents or failures. A information security management scheme for enterprise information system is proposed, which is based on controls checklists obtained from risk evaluation. With this scheme, the management of information security of enterprises can determine what controls should be implemented or check whether some controls are in place or effective to avoid security risks that are potential harm to the business of enterprises.