Maturity assessment and process improvement for information security management in small and medium enterprises

Abstract

SUMMARY Information security is a central concern inside organisations, but it remains quite difficult for most small entities to implement and maintain information security. In this context, the Public Research Centre Henri Tudor and the Luxembourg's Ministry of Economy and Foreign Trade decided to enhance information security awareness and management in Luxembourg's small and medium enterprises. Therefore, our research work aims to propose a method adapted to small and medium enterprises to conduct a first assessment of the enterprises information security maturity and improve their process accordingly. This paper describes the framework developed and presents its validation in industry. The results of applying the method in industry are positive and show a lack in organisational maturity for the information security. The future challenge of this assessment method is to be integrated into an information security web platform and use the large amount of statistics to continuously improve and contextualise the proposed tool. Copyright © 2013 John Wiley & Sons, Ltd.