Title: Business Needs First
Course: IN 2001 Principle of Information Assurance > Section: Module 2: Chapter Two

Business Needs First

Information security performs the following four important functions for an organization:

- Protects the organization’s ability to function
- Enables the safe operation of applications implemented in the organization’s IT systems
- Protects the data the organization collects and uses
- Safeguards the technology assets in use at the organization

Protecting the Functionality of an Organization

Both general management and IT management are responsible for implementing information security to protect the ability of the organization to function.

“Information security is a management issue in addition to a technical issue, it is a people issue in addition to the technical issue.”

To assist management in addressing the need for information security, communities of interest must communicate in terms of business impact and the cost of business interruption and they must avoid arguments expressed only in technical terms.

Enaling the Safe Operation of Applications

Today’s organizations are under immense pressure to create and operate integrated, efficient, and capable applications. The modern organization needs to create an environment that safeguards applications using the organization’s IT systems, particularly those applications that serve as important elements of the organization’s infrastructure.

Once the infrastructure is in place, management must continue to oversee it and not abdicate its responsibility to the IT department.

Protecting Data that Organizations Collect and Use

Many organizations realize that one of their most valuable assets is their data. Without data, an organization loses its record of transactions and/or its ability to deliver value to its customers.

Protecting data in motion and data at rest are both critical aspects of information security.  An effective information security program is essential to the protection of the integrity and value of the organization’s data.

Safeguarding Technology Assets in Organizations

To perform effectively, organizations must add secure infrastructure services based on the size and scope of the enterprise.

When an organization grows and needs more capabilities, additional security services may have to be provided locally.

Likewise, as the organization’s network grows to accommodate changing needs, more robust technology solutions may be needed to replace security programs the organization has outgrown.