Making an information security plan

Abstract

The development objective of this thesis was to create a working, efficient and solid information security plan for a small-sized company. This thesis used qualitative and development methods, such as qualitative interview, literature reviewing as well as researching of the company premises and practices, as well as understanding and awareness of security culture to establish and create the information security plan. The information security plan will consist of a risk management table, as well as an information security-related auditing template, that may and should be used regularly even after the completion of this project, to ensure that the information security of the case company will remain stable and secure.

The overall outcome of the thesis was to strengthen the overall understanding of the importance of the information security within the company, as well as how to avoid jeopardizing it. The information security plan offers cost efficient and simple solutions to strengthen the overall risk assessment and information security awareness of employees within the company, as well as the employer’s, from simple changes in attitude, behavior and habits to further raise awareness and to mitigate the likelihood of targeted attacks succeeding against the company and its employees, such as phishing attempts or malware attacks