Risk management is today a major steering tool for any organisation wanting to deal with information system (IS) security. However, IS security risk management (ISSRM) remains a difficult process to establish and maintain, mainly in a context of multi-regulations with complex and inter-connected IS. We claim that a connection with enterprise architecture management (EAM) contributes to deal with these issues. A first step towards a better integration of both domains is to define an integrated EAM-ISSRM conceptual model. This paper is about the elaboration and validation of this model. To do so, we improve an existing ISSRM domain model, i.e. a conceptual model depicting the domain of ISSRM, with the concepts of EAM. The validation of the EAM-ISSRM integrated model is then performed with the help of a validation group assessing the utility and usability of the model.
- Information system security
Mayer, N., Grandry, E., Feltus, C., Goettelmann, E., & Wieringa, R. J. (2019). An integrated conceptual model for information system security risk management supported by enterprise architecture management. Software and systems modeling, 18(3), 2285-2312. https://doi.org/10.1007/s10270-018-0661-x