Information Security: Applying ISO27001 and risk assessment to records management

Conference 2008 Workshop 2 - Monday 10.30-11.20

Information and records are valuable resources within organisations that need to be protected. Many organisations focus on the protection of their electronic information assets against the risks of loss, misuse, disclosure or corruption. This process is commonly referred to as information security management.

Information security management enables the sharing of information in a manner that ensures the appropriate protection of that information. Risk assessment and management, continuity planning and disaster recovery programmes should all form a part of any information security management system. The aim is to protect information from a wide range of threats in order to:

Minimise the impact of a security breach; safeguard the accuracy and completeness of information; ensure that information is accessible only to those authorised to have access; ensure that authorised users have access to information as, and when, required; maximise return on investments and business opportunities.

Good information security is essential for implementing successful records management. In this workshop, Richard Jeffrey-Cook looks at ISO 27001, the international standard for information security management systems. He will demonstrate how the controls that are applied for information security can be adapted to information management.

ISO 27001 requires a risk managment approach to be adopted to determine the priorities for planning information security improvements and deciding what level of resources should be deployed. This session demonstrates how the same approach can be used to justify an information management strategy and to help build the business case for records management improvements.

Jeffrey-Cook.pdf (.pdf, 102.3 KB)

Richard Jeffrey-Cook, In-Form Consult Ltd

Richard Jeffrey-Cook is a Director In-Form Consult Ltd. Richard has over 20 years of implementing IT solutions to both public sector and private sector organisations and has supplied information management consultancy to, and implemented systems on behalf of, organisations including... more...

Related sessions

Top of the page