INTERNATIONAL ISO/IEC STANDARD 18028-1

ISO/I EC 18028-1:2006(E)Figure 2 — Management Process in the Context of Network SecurityIn Figure 2 the solid black lines represent the main path of the process, and the dotted black line where thetypes of security risk may be determined with the aid of results from a security risk assessment andmanagement review.In addition to the main path of the process, in certain steps there should be a need to re-visit the results ofearlier steps to ensure consistency, in particular the steps "Review Corporate Information Security Policy" and"Review Network Architectures and Applications". For example,— after types of security risk have been determined there may be a need to review corporate informationsecurity policy because something has arisen that is in fact not covered at that policy level,— in identifying potential control areas, the corporate information security policy should be taken intoaccount, because it may, for example, specify that a particular control has to be implemented across theorganization regardless of the risks, and— in reviewing security architecture options, to ensure compatibility the network architectures andapplications should be considered.14 © ISO/IEC2006 - All rights reserved