Management of threats and disturbances
The guidelines must specify
- how to organise information security management
- which operators are responsible for information security
- how these responsible operators may be contacted.
The guidelines must be documented and kept up to date.
The most important objective of the guidelines is to enable identifying the cause of an information security incident as quickly as possible and minimising the impact of the event. The guidelines also have practical importance, for example, in training new personnel.
The guidelines must also take into account any special instructions concerning the corrective measures in case of major disturbances. Such special instructions may concern, for example, on-call or deputy arrangements.
Typically, the organisation of information security management is described in a company’s internal information security policy, which is a set of documents describing the measures and targets of information security that has been approved by the company management.