Information Security Management

Abstract

The main purpose of the thesis was to present different areas of information security controls based on the international information security standard ISO 27001. The thesis also describes the methods of risk analysis and how to establish, implement, maintain and improve information security system in organizations.

Most of the material was collected from books and various online resources. Some information was taken also from the teaching materials of the information security course.

This thesis report provides basic knowledge of information security management in both theoretical and practical aspects. As a practical part of the thesis, a sample checklist for information security evaluation was created.