Assurance Management

IT security experts still talk abstractly about IT security and primarily have measures in mind that increase IT security. Yet they already spend a large part of their time for procuring, evaluating, and communicating information about IT security. Though both activities belong together, the management of information about IT security change significantly when user organizations procure their IT services from independent IT service providers. The user organizations need information about IT security to be able to measure and evaluate IT security and risks. Moreover, this information is required to satisfy the user organization’s auditors, accountants, shareholders, authorities, customers, and other stakeholders. The collection, provision, communication, and evaluation of this information is so central that we regard it as a separate discipline (Assur-ance Management) to which this chapter is dedicated.