Welcome to part 2 of our video series on cyber security.
Part 1 was about the legal requirements to establish an ISMS.
We will now explain what an ISMS is.
An Information Security Management System is a circular business process that promotes cybersecurity.
Step #1: Acquire IT components and put them into operation.
Step #2: Create an inventory and know the components' functionalities.
Step #3: Identify all related risks. Is the processed information available, correct and confidential?
What are the possible attack scenarios?
The result is a list of security risks.
Step #4: Evaluate the risks and find the biggest ones.
Step #5: Hedge the biggest risks.
Step #6: Accept the remaining minor risks for the time being.
Step #7: Report your recent activities to the cybersecurity authority.
Step 8#: Receive the authority's directive.
Step #9: Re-start the process by acquiring new IT components.
That is an Information Security Management System.
All those requirements apply to operators of critical infrastructures.
But how are suppliers affected?
Let's find out in the next video.