Risk Management and Security in Smart Software Pty Ltd Report

This report provides an in-depth analysis of information security management (ISM) at Smart Software Pty Ltd, a leading software organization based in Melbourne. It discusses the application of information security risk management (ISRM) principles, including identification, protection, response, and recovery, tailored to the company's specific context. The report emphasizes the importance of creating business awareness, defining a comprehensive ISRM program, and developing functional capabilities for security and risk management. Metrics and benchmarking are addressed, highlighting the need to align with industry standards like ISO 27000 and NIST. Furthermore, the report explores information security certification and accreditation processes suitable for Smart Software Pty Ltd, outlining eligibility criteria, timelines, and relevant standards. The ultimate goal is to assist Smart Software Pty Ltd in effectively managing its security risks, protecting its information assets, and ensuring compliance with industry regulations. Desklib provides access to this document and many other solved assignments for students.

INFORMATION SECURITY MANAGEMENT
Information Security Management
Name of the Student
Name of the University
Author Note:

iINFORMATION SECURITY MANAGEMENT
Executive Summary
Smart Software Pty Ltd is known to be a leading software organization which is based in
Melbourne. The organization tends to develop a large number of software for their Australian
clients who are based in Melbourne, Sydney and Brisbane. This particular software organization
aims to manage six teams which tends to manage development team, developing codes of
software, sales and project team management. In the coming pages of the report, a discussion has
been provided with respect to application of information risk management. Along with,
information certification and accreditation for this organization has been discussed with respect
to scenario.

iiINFORMATION SECURITY MANAGEMENT
Table of Contents
Introduction..........................................................................................................................4
Discussion............................................................................................................................4
Information security risk management (ISRM)...............................................................4
Creating business awareness........................................................................................7
Defining the program...................................................................................................7
Developing program....................................................................................................8
Metrics and benchmarking..........................................................................................9
Operation and Implementation....................................................................................9
Information Security Certification.................................................................................10
Accreditation to Smart Pty ltd.......................................................................................11
Snapshot.....................................................................................................................12
Private Edition Services.............................................................................................12
Timeline and Process.................................................................................................12
Standard for Smart Software Pty Ltd.........................................................................13
Eligibility Criteria......................................................................................................13
Fee Information.........................................................................................................13
Conclusion.........................................................................................................................14
References..........................................................................................................................14

1INFORMATION SECURITY MANAGEMENT
Introduction
Smart Software Pty Ltd is known to be a leading software organization which is based in
Melbourne. This particular organization is based in Australia which develops software for
business clients in different regions of the world. This organization is handled by CEO who
manages six teams under it like development team, QA team, UX team, Marketing and Sales
team. The development team of this organization aims to develop large number of software
which is needed for UX team user interference. QA team of this organization focus on managing
large number of IT-based resources and operation. Sales and marketing team of this organization
focus on new kind of clients and sales production to clients. Team of project management focus
on managing various kind of software development and making sure that project is completed on
given time. It mainly focuses on understanding the overall needs of the clients. Apart from there
is project manager, who tends to look after various aspects like budget and account who keep a
track of the accounting. It is expected that the overall turnover is around 8 million dollars per
annum.
In the coming pages of the report, an idea has been provided with respect to application
of the principal for information security risk management. After that, an information security
certification and accreditation for the organization has been given for this organization. At
present, the consequence of recent strategic planning has been discussed in details. Smart
Software is now focusing on evaluation of various kind of security risk. The organization is now
reviewing their security policies along with upgrading the security management based services.

2INFORMATION SECURITY MANAGEMENT
Discussion
Information security risk management (ISRM)
Information security risk management (ISRM) can be stated as a process of managing
various kind of risk. It is associated with use of information technology in Smart software Pty
Ltd. It focuses on identifying, treating and lastly accessing to the integrity and availability for
this organizational asset (Kiedrowicz and Stanik 2015). The main goal of this process is all about
treating risk concerning organization overall tolerance of risk. The end goal of this particular
method is all about understanding the overall risk tolerance. The business of this organization
focuses on the fact of addressing various kind of risk. It is all about understanding and achieving
the given risk level for this particular organization (Jacobsson and Davidsson 2015). There are
large number of framework which can help this software organization to building ISRM strategy.
One of the common kinds of framework in the cybersecurity is all about building proper kind of
strategy. It comprises of series of steps like
Identification: Various kind of activity in this group is all about development of proper
kind of understanding with respect to cybersecurity risk in the given system. It mainly tends to
highlight large number of factors like system, people, data and lastly capabilities (Ismail et al.
2018). By the help of business context, all the present business needs and related risk can help
this organization in understanding threats. In this step, the main focus in all about giving priority
to the security efforts. There is large number of activities in this particular asset management,
governing and carrying out risk assessment (Michael 2016).
Protection: Smart Software Pty Ltd focus on implementing certain number of safeguard
and security-based control which is required for protecting the required assets from any kind of

3INFORMATION SECURITY MANAGEMENT
cyber threats (Grover, Reinicke and Cummings 2016). There is large number of activities which
helps in carrying out identity management and access based control. Apart from this, it also
focusses on promoting required awareness and training to the staff members.
Response: Smart Software Pty Ltd focus on addressing the incident of cyber-security
attack (Smit, Zoet and Slot 2016). There is large number of organization which makes use of
certain number of techniques which can create huge amount of impact on the incident. Also, it
tends to focus on certain number of things like response planning, communication, mitigation,
improvement and lastly proper kind of analysis.
Recover: Smart Software Pty Ltd focus on developing along with implementing certain
number of activities which is needed for restoring the given activities. It is mainly impacted by a
list of security-based incidents (Skopik, Settanni and Fiedler 2016). The group members tend to
provide aim which is needed for recovery of thing in timely way. It can be stated as normal way
for reducing the impact from any kind of incident. It mainly includes various kind of phases like
planning, recovery and lasting improvements.
ISRM can be stated as an ongoing method for identifying, assessing along with making
response for the given security risk (Kröger and Sansavini 2016). For managing the risk
ineffective way, organization should focus on the likelihood for the events that can pose a threat
to IT environment. Apart from this, it tends to address the overall effect on each kind of risk.
There is mainly three kinds of criteria for understanding the ISRM strategy ineffective way.
 It focuses on understanding the unacceptable kind of risk which needs to be
identified and addressed properly.
 It emphasizes that both money and effort are not being wasted.

4INFORMATION SECURITY MANAGEMENT
 It can easily provide the senior management for understanding the risk profile
along with treatment.
A large number of focus is made on multi-phase approach which is needed for ISRM
program which is very effective. It can easily result in more comprehensive kind of program
along with understanding the process of risk management (Rosado et al., 2015). It can be
achieved by making an understanding of various kind of required steps. It will ultimately break
the required ISRM method into more manageable kind of action. It is required for fixing various
kind of issues in more easy way (Kott and Arnold 2015).
Creating business awareness
Smart Software Pty Ltd needs to have an understanding concerning the business
condition of this organization(Sadgrove 2016). It mainly tends to focus on the various kind of
budget, complexity of the given business process. Organization needs to address the present risk
profile along with detail description of every kind of risk.
Defining the program
Smart Software Pty Ltd needs to define the program of ISRM by addressing a large
number of points like
Annual plan which is followed by high level three-year plan: An analysis has been
done concerning certain number of goals and objectives which requires to be met. This particular
plan needs to be adjusted so that it can accommodate various kind of changes in the business and
their activities(Singhal and Ou 2017). There are some instances where the capability is proper
place along with required business condition. The timeframe is mainly needed for proper kind of
implementation of program for the interval of 30 to 36 months.

5INFORMATION SECURITY MANAGEMENT
Defining the arrival point for capability-based management input: The overall input
of arrival comes up with proper kind of capabilities for the given organization(Sajid, Abbas and
Saleem 2016). It is considered to be placed as soon the organization can easily address various
kind of program. An individual can look for required kind of point which is needed for
understanding the goals concerning ISRM.
Availability and capability of the necessary staff: The most vital element in the
domain of any ISRM program which is required for proper kind of staffing (Kott and Arnold
2015). There is large number of organization who does not have any kind of qualified staff
members for achieving the objectives. The main focus is all about addressing the objective of
ISRM programs. Along with this, organization does not have any kind of staff members for
achieving objectives for this program.
Having an understanding concerning organization culture: ISRM can be stated a
program which is considered to be very difficult to use. It is mainly done so that organization
does not support any kind of implementation (Ismail et al. 2018). Based on the organization
culture, an individual need to openly discuss the given ISRM program in the given parties. It
focuses on looking for driving proper adaptation of the given program.
Developing program
In this particular phase, Smart Software Pty Ltd needs to address the functional
capabilities and its control. It is related to security and risk management of various aspects like
vulnerability, incident response, training and communication (Shameli-Sendi, Aghababaei-
Barzegar and Cheriet 2016). The governance model helps in understanding the roles and
responsibility of each of the ISRM strategy. If Smart Software Pty Ltd choose outsourcing for

6INFORMATION SECURITY MANAGEMENT
the ISRM capabilities of third parties. It is considered to be very much important for
understanding the risk along with ensuring oversight of internal staff.
Metrics and benchmarking
In this phase, Smart Software Pty Ltd needs to focus on certain the metrics for
understanding the overall effectiveness for this ISRM strategy.
Aligning with industry standard and proper guidelines: There is various kind of
standard to ensure the fact that ISRM program can comply with the rules and regulation. It is
mainly inclusive of ISO 27000, NIST standard for this organization (Jacobsson and Davidsson
2015). For this smart software Pty Ltd, ISO 27000 focus on providing new kind of guideline for
building risk management program. It is all about implementing different kind of compliance
standard and framework which is needed for identifying ISRM program. It mainly tends to
understand the function and capabilities.
Making use of KPI for measuring the effectiveness of the function and capabilities
developed through ISRM program: At the time of developing KPI, an individual need to
understand the new kind of ISRM capabilities. It is mainly needed for defining the objective
which is needed for accessing the required value (Kiedrowicz and Stanik 2015). It will help
smart software Pty Ltd on potential impact and arrival guidelines and assign the required values.
Apart from this, the organization can easily connect with the security posture with the business
context of the smart software Pty Ltd.
Operation and Implementation
Smart software Pty Ltd needs to go through the different stages of ISRM that is
identified, detect, respond, recover and protect and lastly repeating them on a regular basis. It is

7INFORMATION SECURITY MANAGEMENT
very much important for this organization to come up with certain policy that describes all the
required stages of ISRM (Michael 2016). All the major responsibilities of employees and
schedule of the condition need to be reviewed for the given program. There is large number of
changes in the present IT environment which is related to data breaches in the industry or even
cyber-attacks.
Information Security Certification
In the last few years, various organization around the globe have understood the
importance of cybersecurity breaches which is suffered by organization like Facebook. So, Smart
Software Pty Ltd should take up necessary steps for understanding for making response to
information security breaches (Grover, Reinicke and Cummings 2016). A few members of this
organization are considered to be a part of both team manager and teleworks in which they tend
to work from home. But in some of the cases, they turn to offices for attending meeting and catch
up with teammates. Smart Software Pty Ltd has given help to teleworkers with laptops to visit
frequently can connect to the office networks through VPN. Marketing and sales team members
are required to visit their client offices and provide after-sales services. Smart Software Pty Ltd
can easily make use of different kind of tools and vision control software and application. It
comes up with packing tools which are needed for developing large number of products. Very
few software and tools are licensed but majority of the software is free and open source
(Goodwin et al. 2015). This particular organization can make use of different kind of files and
documents like user needs, software design and software codes. As this organization is focusing
on strategic planning, so an evaluation is carried out with risk and look. It is all about review of
security policies along with upgrading the security management practices.

8INFORMATION SECURITY MANAGEMENT
Certified Ethical Hacker (CEH): Hackers are nothing but innovator who is constantly
finding new kind of ways for tracking the system information along with exploiting the
vulnerabilities (dos Santos Lonsdale, Lonsdale and Lim 2018). Most of the business organization
like Smart Software Pty Ltd focus on protecting the information system by engaging their
services. It focuses on gaining skills in beating hackers at their own time. This particular
organization can follow this information security intermediate level which is being offered by
International Council for e-commerce consultant.
Certified Information Security Manager (CISM): It can be defined as new kind of top
credential which is needed by various IT professionals for managing, overseeing different kind
of information security system. In the year 2003, CISM was introduced to various kind of
security professional by ISACA (Da Veiga and Martins 2015). The main goal of this certification
is to provide the target needs of various IT professionals by the enterprise level security
management. There is large number of holders of credential which comes up with skill and
advanced process in security risk management and program development.
Comp TIA Security+: It is considered to be a well-respected, vendor natural security
certification (Chafjiri and Mahmoudabadi 2018). Security+ credential holders that are Smart
Software Pty Ltd can easily recognize the processing of superior technical skills and expertise in
different security-related discipline related threats. The only drawback for making of security+ is
that, it known to be an entry-level certification in that IT department employee should have two
years of experience.
Certification information system professional (CISSP): It can be defined as an
advanced level of certification for IT-based industries which comes up with career in the domain

9INFORMATION SECURITY MANAGEMENT
of information security (Alreemy et al. 2016). It has been designed in such a way that it can
guide various security professional.
SANS GIAC Security Essentials: It is known to be an entry-level credential which has
been designed for various professionals for understanding the terminology of information system
of Smart Software Pty Ltd (Ahmad, Maynard and Shanks 2015). Apart from this, it focuses new
skills and expertise which is needed for occupying hand on security goals.
Accreditation to Smart Pty Ltd
Accreditation can be defined as a process of reviewing which helps the healthcare
organization for understand their overall ability for meeting requirements and established
standard. Accreditation can easily focus on agency dedication and commitment for meeting the
required standard which is defined by the high level of performance (Ab Rahman and Cho 2015).
Private organization Accreditation can be defined as a social kind of service which is needed by
most non-profit organization. It is all about review for the entire organization which is inclusive
of administrative operation.
Snapshot
 Four year- accreditation
 Proper review of the organization services and administration.
 Online process and user friendly
 Process generally takes around 12- 18 months
 Standard and accreditation are considered to be free.