Preface |
|
xv | |
About the Authors |
|
xvii | |
Introduction |
|
1 | (6) |
|
|
1 | (2) |
|
|
3 | (1) |
|
|
3 | (1) |
|
|
4 | (1) |
|
Section 1: IT Governance: Definitions and Standards |
|
|
4 | (1) |
|
Section 2: Maturity Frameworks for Information Technology Governance |
|
|
5 | (1) |
|
Section 3: Maturity Frameworks for Information Security Governance |
|
|
5 | (2) |
Section 1 IT Governance: Definitions and Standards |
|
7 | (78) |
|
1 Information System and IT Governance Evolution |
|
|
9 | (36) |
|
|
9 | (25) |
|
1.1.1 Information System Definition and Objective |
|
|
11 | (1) |
|
1.1.2 Information System Concept |
|
|
12 | (3) |
|
1.1.3 Concepts of Enterprise Application |
|
|
15 | (1) |
|
1.1.4 Features of Enterprise Applications |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
1.1.9 EIS and Company Strategy |
|
|
18 | (2) |
|
1.1.10 Enterprise Information Systems Complexity |
|
|
20 | (1) |
|
1.1.11 Complexity Factors |
|
|
20 | (1) |
|
1.1.12 Evolution of EIS's |
|
|
21 | (1) |
|
|
22 | (4) |
|
|
26 | (3) |
|
1.1.14.1 The Metaphor of the City |
|
|
26 | (2) |
|
1.1.14.2 The Urbanization of Information System |
|
|
28 | (1) |
|
|
29 | (1) |
|
|
30 | (16) |
|
1.1.16.1 IS Organizational Design |
|
|
30 | (2) |
|
1.1.16.2 Competencies and Skills of IS Professionals |
|
|
32 | (1) |
|
|
33 | (1) |
|
1.1.16.4 Design of IT Infrastructure |
|
|
33 | (1) |
|
|
34 | (11) |
|
2 IT Governance and Information Security: Guides and Standards |
|
|
45 | (40) |
|
|
45 | (1) |
|
|
46 | (11) |
|
2.2.1 The Word of the IT Governance Subject |
|
|
49 | (3) |
|
2.2.2 The Word of IT Governance Usage |
|
|
52 | (1) |
|
2.2.3 The Word of the IT Governance System |
|
|
53 | (2) |
|
2.2.4 The Word of IT Governance Development |
|
|
55 | (2) |
|
2.3 IT Governance Standards |
|
|
57 | (17) |
|
|
61 | (4) |
|
|
65 | (1) |
|
2.3.3 Structure of ITIL v4 |
|
|
66 | (2) |
|
|
68 | (2) |
|
|
69 | (1) |
|
|
69 | (1) |
|
|
69 | (1) |
|
2.3.4.4 Level 4: Quantitatively Managed |
|
|
70 | (1) |
|
2.3.4.5 Level 5: Optimizing |
|
|
70 | (1) |
|
2.3.5 Committee of Sponsoring Organizations of the Treadway Commission (COSO) |
|
|
70 | (2) |
|
|
72 | (1) |
|
2.3.7 ISO/IEC 27001: 2005 (Revised by ISO/IEC 27001: 2013) |
|
|
72 | (2) |
|
2.4 ISO/IEC 27002: 2005 (Revised by ISO/IEC 27002: 2013) |
|
|
74 | (1) |
|
2.5 ISO/IEC 27002: 2005 (Revised by ISO/IEC 27002: 2021) |
|
|
74 | (5) |
|
|
75 | (1) |
|
|
75 | (1) |
|
2.5.3 Implementation Tiers |
|
|
76 | (1) |
|
|
76 | (1) |
|
2.5.5 Comparison and Analysis |
|
|
76 | (3) |
|
|
79 | (6) |
Section 2 Maturity Frameworks for Information Technology Governance |
|
85 | (102) |
|
3 IT Governance in Organizations: A Maturity Framework Based on COBIT 5 |
|
|
87 | (42) |
|
|
87 | (2) |
|
3.2 Background and Literature Review |
|
|
89 | (2) |
|
3.3 Theoretical Framework |
|
|
91 | (5) |
|
|
96 | (2) |
|
3.5 Exploring IT Governance in MENA Medium and Large Organizations |
|
|
98 | (3) |
|
|
99 | (1) |
|
|
100 | (1) |
|
|
101 | (4) |
|
|
105 | (18) |
|
|
111 | (3) |
|
|
114 | (1) |
|
3.7.3 Assessing Capability Maturity |
|
|
114 | (2) |
|
3.7.4 Capability Level Analysis |
|
|
116 | (1) |
|
3.7.5 Maturity Level Analysis |
|
|
116 | (1) |
|
|
117 | (2) |
|
|
119 | (4) |
|
|
123 | (6) |
|
4 IT Service Management as a Key Pillar for IT Governance: A Maturity Framework Based on ITILv4 |
|
|
129 | (28) |
|
|
129 | (2) |
|
|
131 | (2) |
|
4.2.1 Agility in Literature |
|
|
132 | (1) |
|
4.3 The Proposed ITSM/ITAM Framework |
|
|
133 | (14) |
|
4.3.1 IT Service Management (ITSM) |
|
|
135 | (2) |
|
4.3.2 IT Asset Management (ITAM) |
|
|
137 | (1) |
|
4.3.3 IT Security Management |
|
|
138 | (1) |
|
|
139 | (6) |
|
4.3.5 The Proposed Agile ITSM/ITAM Framework |
|
|
145 | (2) |
|
|
147 | (7) |
|
|
147 | (1) |
|
|
147 | (1) |
|
|
147 | (1) |
|
4.4.4 IT Security Audit Result |
|
|
148 | (1) |
|
|
149 | (3) |
|
4.4.5.1 The Practical Framework to Enhance ITSM/ITAM Efficiency |
|
|
149 | (3) |
|
|
152 | (1) |
|
4.4.7 Benefits of the Proposed Agile ITSM/ITAM after Implementation in the Organization |
|
|
153 | (1) |
|
|
154 | (3) |
|
5 Cloud Computing as a Key Pillar for Agile IT Governance |
|
|
157 | (30) |
|
|
157 | (1) |
|
|
158 | (1) |
|
5.3 Theoretical Foundation |
|
|
159 | (2) |
|
5.4 Combining DOI and TOE |
|
|
161 | (2) |
|
5.5 Research Model and Hypotheses |
|
|
163 | (1) |
|
5.6 The Innovation Characteristics |
|
|
163 | (3) |
|
5.7 Technological Readiness |
|
|
166 | (1) |
|
5.8 The Organization Context |
|
|
166 | (1) |
|
5.9 The Environmental Context |
|
|
167 | (1) |
|
5.10 Research Methodology |
|
|
167 | (1) |
|
5.10.1 Quantitative Methodology |
|
|
167 | (1) |
|
|
168 | (1) |
|
|
168 | (1) |
|
|
169 | (4) |
|
|
173 | (1) |
|
5.14 Organizational Context |
|
|
174 | (1) |
|
5.15 Environmental Context |
|
|
174 | (1) |
|
5.16 Discussion and Interpretations |
|
|
174 | (1) |
|
5.17 The Proposed Cloud Governance Framework |
|
|
175 | (1) |
|
5.18 Policies and Principles |
|
|
175 | (2) |
|
|
177 | (2) |
|
|
179 | (1) |
|
|
180 | (2) |
|
|
182 | (5) |
Section 3 Maturity Frameworks for Information Security Governance |
|
187 | (106) |
|
6 Information Security Governance: Best Practices in Organizations |
|
|
189 | (26) |
|
|
189 | (1) |
|
6.2 Literature Review and Background |
|
|
190 | (2) |
|
|
192 | (5) |
|
|
192 | (2) |
|
6.3.2 Demography Characteristics |
|
|
194 | (1) |
|
6.3.3 Measurement Survey Model |
|
|
195 | (2) |
|
|
197 | (7) |
|
6.4.1 IT Security Governance Knowledge |
|
|
197 | (1) |
|
6.4.2 Conditions for Implementing Information Security Governance |
|
|
197 | (2) |
|
6.4.3 Strategic Issues in Information Security Governance |
|
|
199 | (1) |
|
6.4.4 IT Security Governance Strategy and Metrics |
|
|
200 | (1) |
|
6.4.5 IT Service and Asset Security Management |
|
|
200 | (1) |
|
6.4.6 Vulnerability and Risk Management |
|
|
201 | (1) |
|
6.4.7 Information Security Compliance, Control, and Verification |
|
|
201 | (1) |
|
6.4.8 Organizational Maturity of Information Security Governance |
|
|
202 | (2) |
|
6.5 Discussion and Interpretation |
|
|
204 | (3) |
|
|
207 | (4) |
|
|
211 | (2) |
|
|
213 | (2) |
|
7 Information Security Governance: A Maturity Framework Based on ISO/IEC 27001 |
|
|
215 | (32) |
|
|
215 | (2) |
|
7.2 Theoretical Framework |
|
|
217 | (6) |
|
|
218 | (1) |
|
|
219 | (3) |
|
7.2.3 Framework Maturity Profile |
|
|
222 | (1) |
|
|
223 | (13) |
|
|
224 | (1) |
|
|
225 | (1) |
|
7.3.3 Conducting Assessments |
|
|
225 | (1) |
|
7.3.4 Assessing Capability Maturity |
|
|
226 | (1) |
|
7.3.5 Developing Improvement Action Plans |
|
|
227 | (9) |
|
|
236 | (3) |
|
|
239 | (2) |
|
|
241 | (6) |
|
8 Information Security Policy: A Maturity Framework Based on ISO/IEC 27002 |
|
|
247 | (46) |
|
|
247 | (4) |
|
|
249 | (1) |
|
8.1.2 Research Question/Approach |
|
|
250 | (1) |
|
|
250 | (1) |
|
|
251 | (11) |
|
8.2.1 The ISO/IEC 2700x Family |
|
|
254 | (8) |
|
|
255 | (1) |
|
8.2.1.2 ISO/IEC 27002: 2005 (Revised by ISO/IEC 27002: 2013) |
|
|
256 | (1) |
|
8.2.1.3 ISO/IEC 27002: 2005 |
|
|
256 | (1) |
|
8.2.1.4 ISO/IEC 27002: 2005 |
|
|
256 | (5) |
|
8.2.1.5 Other ISO 27000 Standards |
|
|
261 | (1) |
|
|
262 | (5) |
|
|
262 | (1) |
|
|
263 | (1) |
|
8.3.3 Results and Discussion |
|
|
264 | (3) |
|
|
267 | (12) |
|
|
269 | (1) |
|
|
269 | (1) |
|
|
270 | (1) |
|
|
270 | (1) |
|
8.4.5 ISSP Issues in the PUBLIC_ORG |
|
|
270 | (1) |
|
8.4.6 Security Requirements |
|
|
271 | (1) |
|
|
271 | (8) |
|
8.4.7.1 Organization of Information Security |
|
|
271 | (2) |
|
8.4.7.2 Information System Security Policy |
|
|
273 | (1) |
|
|
274 | (1) |
|
8.4.7.4 Human Resources Security |
|
|
274 | (1) |
|
8.4.7.5 Physical and Environmental Safety |
|
|
275 | (1) |
|
8.4.7.6 Operations Management |
|
|
275 | (1) |
|
|
276 | (1) |
|
|
277 | (1) |
|
8.4.7.9 System Acquisition, Development, and Maintenance of Information Security |
|
|
277 | (1) |
|
8.4.7.10 Supplier Relationships |
|
|
278 | (1) |
|
|
278 | (1) |
|
|
279 | (4) |
|
|
283 | (10) |
Conclusion |
|
293 | (2) |
References |
|
295 | (22) |
Acronyms |
|
317 | (2) |
Index |
|
319 | |