Making Sense of InformationSystems Security Standards

摘要

In the realm of information systems (IS) security, a plethora of standards have come into existence. Too many IS securityrnstandards have been proposed, which an organization could adopt to secure its information systems. On what criteria then anrnorganization shall base its decision as to what standards need to be implemented? We address this concern employing basicrneconomic concepts. The core argument of research presented in this paper is that an organization should incorporate arnminimum set of standards to cover maximum IS security needs of an organization. The position of adopting a different ISrnsecurity standard for every process in an organization defies the concept of efficiency.