Using survey to estimate the effort of setting up an Information Security Management System: Case ITC Organizations

摘要

The adoption of principles and methodologies for process development that take into account information security is becoming increasingly widespread. Many organizations around the world have information security management systems that meet the requirements of ISO 27001 [1]. To meet the requirement of ISO 27001 the organization must expend effort in time and money. The effort depends mainly on the size of the organization and the status of the information security management system. The objective of this article is to find a mathematical model for estimating the effort to implement an Information Security Management System (ISMS) certified ISO 27001. In this study, we present the design of the survey that was sent to 1040 organizations from different areas, and that was conducted between 2016 and 2017. we have two main questions to answer on this article, what are the variables that affect the effort of setting up an ISMS? and how do you choose the best forecasting models for the effort? We present the different parameters that we will use to select the best regression model, what are the R~2, Mean Square Error "MSE", Root Mean Square Error "RMSE", Mean Absolute Percentage Error "MAPE" and Mean Absolute Error "MAE". After We still developing the best model that we will use to estimate the effort to implement the Information Security Management System (ISMS) for all kind of organization, after a fist try with ITC organizations.