Abstract:Abstract In the current global context, companies need a defined minimum level of information security to recognize and deal with related threats and risks. Due to market, customer or legal requirements, specifications and requirements for information security are implemented uniformly according to standards such as the information security management standard ISO/IEC 27001 or industry-specific standards such as Trusted Information Security Assessment Exchange - TISAX, ISO IEC 27019 Energy Utility Information Security Standard. The conformity to these standard requirements within the established management system is checked during periodically required audits. However, there are various reasons for which, even after many years of audits in companies, there are still insufficient process implementations for information security requirements. The aim of the paper is to analyze the status of conformity and thus also the process maturity in selected samples of companies that have already had information security management systems (ISMS) implemented for several years. In detail, the reasons for deviations from the minimum requirements with associated risks for the security of information in companies were analyzed, which allow conclusions to be drawn about possible process improvements. The paper also analyzes why, despite established measures and existing expertise, only a limited level of process maturity is achieved on average. Other possible approaches to the implementation procedure for dealing with non-conformities in information security are also considered. The results of this research show that there is a need for an adjusted continuous improvement process, which makes risks resulting from insufficient process maturity more visible. Proposals for such improvements are listed.

Building a Viable Information Security Management System

A process framework for information security management

Research on Information Security Model and Security System Design

Development of an Information Security Management Model for Enterprise Automated Systems

Integrated Solution Modeling Software: A New Paradigm on Information Security Review

Integrated Solution Modeling Software: A New Paradigm on Information Security Review and Assessment

A Framework of Information Security Integrated with Human Factors

An integrated system theory of information security management

A checklist based evaluation framework to measure risk of information security management systems

A comprehensive model of information security factors for decision-makers

The Evolution of Information Security Strategies: A Comprehensive Investigation of INFOSEC Risk Assessment in the Contemporary Information Era

Developing a Risk Analysis Strategy Framework for Impact Assessment in Information Security Management Systems: A Case Study in IT Consulting Industry

Analysis of Relationships between Non-conformities, Process Maturity and Continual Improvement in Information Security Management Systems

Building Security Awareness of Interdependent Services, Business Processes, and Systems in Cyberspace

Information Security Policy: A Management Practice Perspective

A situation awareness model for information security risk management

Security in IS and social engineering -- an overview and state of the art

Improvement of information system security risk management

Information security management standards: Problems and solutions

Information Security Strategy in Organisations: Review, Discussion and Future Research Directions

Information Security Management: A Hierarchical Framework for Various Approaches