A Framework for Information Security Risk Management Communication.

Organisations have over the last couple of years become more aware of the importance of information security risk management and its corresponding due diligence requirements. A cornucopia of information security risk management approaches exist that can assist organisations in determining and controlling risks. However, with these choices organisations are finding it increasingly difficult to communicate the information security risks to the strategic level or for strategic management to communicate information security goals to the organisation. An approach is necessary that will enable organisations to communicate information security risk information to strategic level management quickly and unambiguously. This approach will have to provide information in accordance with corporate governance requirements and be based on best practice. This article suggests a framework that was developed from best practice and industry standards, and takes into consideration various information security risk management approaches.