Abstract:Abstract In the current global context, companies need a defined minimum level of information security to recognize and deal with related threats and risks. Due to market, customer or legal requirements, specifications and requirements for information security are implemented uniformly according to standards such as the information security management standard ISO/IEC 27001 or industry-specific standards such as Trusted Information Security Assessment Exchange - TISAX, ISO IEC 27019 Energy Utility Information Security Standard. The conformity to these standard requirements within the established management system is checked during periodically required audits. However, there are various reasons for which, even after many years of audits in companies, there are still insufficient process implementations for information security requirements. The aim of the paper is to analyze the status of conformity and thus also the process maturity in selected samples of companies that have already had information security management systems (ISMS) implemented for several years. In detail, the reasons for deviations from the minimum requirements with associated risks for the security of information in companies were analyzed, which allow conclusions to be drawn about possible process improvements. The paper also analyzes why, despite established measures and existing expertise, only a limited level of process maturity is achieved on average. Other possible approaches to the implementation procedure for dealing with non-conformities in information security are also considered. The results of this research show that there is a need for an adjusted continuous improvement process, which makes risks resulting from insufficient process maturity more visible. Proposals for such improvements are listed.

Governing Information Security in Conjunction with COBIT and ISO 27001

Improving the quality of information security management systems with ISO27000

Analysis of the User Acceptance for Implementing ISO/IEC 27001:2005 in Turkish Public Organizations

The ISO/IEC 27001 Information Security Management Standard: How to Extract Value from Data in the IT Sector

Information security management standards: Problems and solutions

Planning, Managing and Monitoring Technological Security Infrastructures

Organization Security Architecture and Model of Intelligence ISMS

Analysis of Relationships between Non-conformities, Process Maturity and Continual Improvement in Information Security Management Systems

A process framework for information security management

An Adaptable Maturity Strategy for Information Security

Developing a Risk Analysis Strategy Framework for Impact Assessment in Information Security Management Systems: A Case Study in IT Consulting Industry

Cloud Computing Security in Business Information Systems

Integrated Solution Modeling Software: A New Paradigm on Information Security Review

Overview of the Impact of Human Error on Cybersecurity based on ISO/IEC 27001 Information Security Management

An Information Security Performance Measurement Tool for Senior Managers: Balanced Scorecard Integration for Security Governance and Control Frameworks

Integrated Solution Modeling Software: A New Paradigm on Information Security Review and Assessment

Building a Viable Information Security Management System

Refinement of Strategy and Technology Domains STOPE View on ISO 27001

The Evolution of Information Security Strategies: A Comprehensive Investigation of INFOSEC Risk Assessment in the Contemporary Information Era

Information Security Management of Web Portals Based on Joomla CMS

Convergence of Corporate and Information Security