Quality Alchemist (品質煉金術師): PMI Seminar on QMS based Information Security Management

2015年4月24日星期五

PMI Seminar on QMS based Information Security Management

I was honor to be invited as speaker for the PMI seminar entitled "Case Study on the Project Implementation of Quality based Information Security Management" was organized by Project Management Institute (PMI) Hong Kong Chapter on 24th Apr 2015. The aim of this seminar to share the system approach through integrated implementation of an Information Security Management System (ISMS – ISO 27001) and Quality Management System (QMS – ISO 9001), as well as, case study in Technology Support Centre (TSC) of Hong Kong Science and Technology Parks Corporation (HKSTP).

In the beginning, I (Former Chairman, HKSQ; Manager, Quality System, TSC-HKSTP) introduced some background of ISO 27001 and ISO 9001. Our ISO 27001 has certified since 2008. So I briefed many security incidents which had happened in 2008 initially.

Then I classified different Control Objectives and Controls into five groups and they were “Policy”, “Process & Procedure”, “Organization Structure”, “Hardware” and “Software”.

The comparison of company registration on ISO 9001 and ISO 27001, it was found that number of ISO 9001 certified companies were much higher than number of ISO 27001 certified companies. It should be a barrier for company to achieve ISO 27001. Therefore, my study was to develop a model so as to fill the gap.

ISO 9001 and ISO 27001 principles and standard comparison was discussed. In next stage, I explained how to extract the core elements of both standards and developed “QMS based Information Security Management (QISM) Model”. However, the core element of this model was Risk Assessment. “Information Security FMEA Cycle” was introduced and 24-steps QISM Implementation Roadmap was mentioned.

At the end, I used the term “SECURE” to be my concluded. Its meaning showed below:
S – Standardization
E – Effectiveness
C – Clearance
U – Unique Identification
R – Recovery
E – Efficiency