Alinhamento entre COBIT e ISO 27005:2008 na gestão de riscos de TI

Abstract

Nowadays Risk Management (RM) in Information Security (IS) has become indispensable for business organizations and it has been triggered several times by the necessity of acting in response to laws, regulations, standards or norms. When facing the challenge to implement RM in effective SI, managers end up developing actions without delineating any structure or work methodology. Therefore the expected objective is not reached what generates redoing and costs for the company. The objective of the work presented here is to elaborate a structured model in stages to implement RM for IS which is aligned to PO09 process “Assess and Manage IT Risks” from CobiT 4.1 and regulations from NBR ISO/IEC 27005:2008 thus defining an order for the implementation of the main actions to be executed. Through this structured model, it gets evident that the usage of only one norm or framework is not enough; being necessary a complement of one or more norms or framework to expand the scope of RM in IS in order to assure its effectiveness.