Abstract:Today, information is rapidly increasing. For most of this information, data security and protection from unauthorized access are of great importance. Maybe information is created by an individual or a few people, but creating security for the information should be done by all assets of hardware, software and people. This entails organizing all elements of the system, and training and monitoring the performance of the people. One of the standards provided for the creation of security is ISMS. This standard is intended to provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a system in terms of security. ISMS receives several parameters from users, assesses the risks and offers some controls (guidelines) to improve them. Collecting primary parameters is also very important in ISMS. Usually these parameters are collected personally, which result in getting inaccurate outcomes. The most important parameters include confidentiality, integrity, availability, threat and vulnerability. This paper tries to provide a method based on checklists so that by assessing the users’ responses to these checklists, one can more accurately insert the vulnerability parameter value as a standard input of ISMS, in order to gain better outcomes, and more accurately perform choice of controls. In the assessment, the standard deviation method is calculated, and comparison between the common mode of ISMS and the proposed method shows that the latter works 30% better than the conventional method. People may refuse to respond sincerely due to different reasons, and the percentage of the results may differ, since the results are obtained as cross-sectional at a certain time.

A situation awareness model for information security risk management

Information security management: An information security retrieval and awareness model for industry

Development of an Information Security Management Model for Enterprise Automated Systems

Improvement of information system security risk management

Towards Ontological Approach to Security Risk Analysis of Information System: Model and Architecture

Integrated Solution Modeling Software: A New Paradigm on Information Security Review and Assessment

Integrated Solution Modeling Software: A New Paradigm on Information Security Review

Risk management model for information security

A Hierarchical Framework of Security Situation Assessment for Information System

Information Security Policy: A Management Practice Perspective

Organizational information security as a complex adaptive system: insights from three agent-based models

Risk management framework for information systems and organizations:: a system life cycle approach for security and privacy

A comprehensive model of information security factors for decision-makers

A checklist based evaluation framework to measure risk of information security management systems

Building a Viable Information Security Management System

Information Security Strategy in Organisations: Review, Discussion and Future Research Directions

Information Security Risks Assessment: A Case Study

Information security management and modelling

The Evolution of Information Security Strategies: A Comprehensive Investigation of INFOSEC Risk Assessment in the Contemporary Information Era

Situational Awareness based Risk-Adapatable Access Control in Enterprise Networks

An risk measurement model for assessing information systems