Information Security Management.

Meeting best practice requirements for Information Security Management standards such as BS ISO/IEC 27001:20005 and ISO 17799, Part 2.Achieving continuous business improvement through consistency, efficiency and accountability.

Requirements generally for regulatory compliance in many areas across the organization are providing a catalyst for companies to understand and tackle information risk challenges. Adoption of the ISO 27001:2005 standard for Information Security Management Systems is seen as an effective way for an organisation to demonstrate to both itself and others that information security requirements have been addressed in a systematic and comprehensive way.

With the intangible assets of many organizations now being worth as much if not more than their tangible assets, information security is now a greater concern than ever before for senior executives. Corruption, loss or theft of corporate data presents a significant and potentially disastrous issue and legislation to control the management of data is growing globally.

It is increasingly being recognized that computer security technology on its own simply does not protect information. In fact, on its own it can give a false sense of security and can lead to decreases in business efficiency.
By using industry best practice standards as a baseline organisations can more effectively avoid a security breach that may seriously damage their business. Additionally, by adopting a single Governance Risk & Compliance Management platform multiple areas of risk management can be administered through a common interface. This delivers economies of scale for implementation, training and continual development and addresses some key challenges within the business.

Senior management challenges: Lack of visibility
Increased administrative burden
Culture change requirements
Potential personal and corporate impact

Functional management challenges: Time-consuming tasks
Disconnected information that’s difficult to find and difficult to manage
Difficulty of implementing changes in regulations
Loss of time spent completing mandatory reports

User challenges: Resistance to change
Lack of understanding of potential business impact
Temptation to disregard if perceived as time-consuming and complex
True business benefits not understood

I.T. challenges:Support from the vendor
Scalability and flexibility
Integration with existing infrastructure
Ease of use/user takeup

The need for change: An effective solution to many of these issues will not only help achieve compliance by automating processes, but will deliver fast return on investment and continuous business improvement.
To achieve the greatest return the solution must prove its value fast, smoothing the way to cultural change without causing disruption to the business. Achiever Plus solutions answer these requirements.

Achiever Plus goes beyond simply managing information security more effectively. While Achiever Plus enables organisations to automate costly and time-consuming manual processes, it also offers the opportunity to reassess and redesign processes and procedures in line with business objectives. At the same time, by highlighting potential issues before they arise, Achiever Plus enables companies to become proactive rather than reactive in dealing with regulatory issues.

Achiever Plus is a flexible, modular solution designed to help you to meet information security requirements across the enterprise, as part of a corporate wide GRC solution. Each module addresses key issues in your compliance solution.

Information Security Management. - cont.

Meeting best practice requirements for Information Security Management standards such as BS ISO/IEC 27001:20005 and ISO 17799, Part 2

Module Supporting Information Security Management and adherence to BS ISO/IEC 27001:2005 standards

Document Management Management of the creation, review, approval and distribution of documents such as policies, responsibilities, procedures, work instructions, legislation register, and emergency preparedness procedures.
Prevents the unintended use of incorrect documents.
Automated document protection and retention rules.
Integration and cross referencing between risk assessments, procedures and equipment validation documents.
Enterprise-wide involvement in the change process.
Integrates with Microsoft Office for document creation.

Risk Assessment Record vulnerability and threat details in a risk register.
Provides for a fully configurable risk classification.
Manages the allocation, notification and completion of actions as part of the risk treatment plan.
Ensures that periodic re-assessments are completed and escalated where required.
Automate the creation of a statement of applicability.

Incident Reporting Provides enterprise–wide incident management.
Simple completion of the initial incidents.
Manages records of security incidents.
Enforces a culture of corrective and action to prevent re-occurrence.
Provides comprehensive cost analysis and reporting of incidents.

Competence and training records management Provides a tool for determining necessary competency of personnel based on job title.
Maintains records of education, training, skills and experience.
Automates the process of retraining as processes change. As documents are re-published in document management training requirements are generated automatically.

Audits and corrective action management Manages the audit checklists for auditing information security procedures, processes, departments etc.
Audit profiles can be created for any area or process, detailing the frequency and responsibilities of the audit.
Managing audit reports, including electronic sign-off by the Auditor and Auditee.
Creating and managing observations, non-conformances and corrective actions associated with audits.

Meetings Management Documenting management system reviews.
Recording and other operational meetings.
Managing resulting actions.
Formal sign-off where required.

Equipment Management Generate an asset register of equipment in the organisation
Managing processes that ensure equipment is effectively managed and that regular inspection and testing is completed and documented.

Contact Management Demonstrating effective communication with relevant parties, such as suppliers, contractors and regulatory bodies, including managing feedback, non- conformances and complaints.

Graphical Reporting Analysis of the data within Achiever Plus to enable appropriate preventive action and reporting to be completed.

Benefits of Achiever Plus:Achiever Plus compliance software solutions are modular and flexible management systems designed specifically to address the needs of businesses aiming for Governance, Risk & Compliance management and associated business improvement.

Achiever Plus helps organisations achieve sustainability and consistency in the management of information, through the more efficient use of resources and application of systems, and the opportunity to introduce accountability, to ensure that any issues that arise are resolved and do not reoccur.