ISM3 Released
The publication of ISM3 v1.20 (Information Security Management Maturity Model, pronounced ISM cubed) offers many advantages for information security management systems. ISM3 can be used standalone or enhance systems based on ITIL, ISO27001 or Cobit.
The principal approach of ISM3 is based on “Achievable Security” rather than “Absolute Security”. By achievable security, ISM3 intends that the objective of Information Security should ensure the realization of business objectives. The traditional view that “Information Security is to prevent attacks” is not realistic. ISM3 achieves this by mapping the business objectives (e.g. deliver products on time) of an organization directly to security objectives (e.g. ensure database access only to authorized users).
More on: http://www.ism3.com/