Show contents
Information security protects information against unauthorised access, disclosure, alteration, destruction or loss. It covers information in every form: digital files and systems, paper records, knowledge held by employees and conversations that contain sensitive details.
What is information security?
Information security is the coordinated protection of information according to its value, use and risk. It combines governance, people, processes, technology and physical safeguards rather than treating security as an IT-only task.
The objective is not to eliminate every possible risk. Organisations identify the information they depend on, assess credible threats and implement controls that reduce risk to an acceptable level. Those decisions should be reviewed as the organisation, technology and threat landscape change.
The three core objectives of information security
The best-known information security objectives are confidentiality, integrity and availability, often called the CIA triad.
Confidentiality
Information is confidential when only authorised people, systems or organisations can access it in the permitted way. Role-based access, encryption, secure authentication, classification and confidentiality rules can support this objective.
Integrity
Integrity means that information is complete, accurate and protected against unauthorised or accidental change. Version control, validation, change approvals, digital signatures and tamper-evident logs can help maintain integrity.
Availability
Availability means that authorised users can access information and services when they are needed. Redundancy, protected backups, tested recovery procedures, monitoring and incident response are typical safeguards.
Depending on the context, organisations also consider objectives such as authenticity, accountability and non-repudiation. These complement the CIA triad when the origin of information, traceability of actions or proof of transactions matters.
Information security, IT security and data protection
The terms overlap but describe different scopes:
- Information security protects information in any form, including digital systems, paper files and human knowledge.
- IT security focuses on information technology such as devices, software, networks and cloud services. It is an important part of information security.
- Cybersecurity concentrates on risks and attacks in connected digital environments.
- Data protection and privacy concern the lawful and fair handling of personal data and the rights of individuals. Security is one requirement of data protection, but not its only requirement.
Information security does not protect only company data, and data protection does not protect only consumers. When an organisation processes personal data, its privacy and security work must fit together.
Examples of information security controls
Technical controls can include:
- multi-factor authentication and role-based access
- encryption for stored and transmitted information
- secure configurations, updates and vulnerability management
- logging, monitoring and alerting
- segmentation of networks and protected remote access
- tested backups and recovery capabilities
Organisational and physical controls can include:
- an information security policy and assigned responsibilities
- risk assessments and documented treatment decisions
- onboarding, role-change and offboarding procedures
- staff awareness and role-specific training
- supplier security requirements and reviews
- incident reporting, response and lessons learned
- visitor management and restricted physical areas
- business-continuity and crisis-management exercises
Controls should be linked to identified risks and evidence. A policy that is not communicated or followed does not protect information; a backup that has never been restored is not proven to support recovery.
What is an information security management system?
An information security management system (ISMS) is the framework an organisation uses to manage information security systematically. It connects business context, policies, risk assessment, controls, responsibilities, measurement and continual improvement.
ISO/IEC 27001:2022 defines requirements for establishing, implementing, maintaining and continually improving an ISMS. An organisation can use those requirements without seeking certification. Certification is a separate, voluntary conformity-assessment process unless a contract or sector-specific rule requires it.
In Germany, the BSI Standard 200-1 describes general requirements for an ISMS and is compatible with ISO/IEC 27001. BSI IT-Grundschutz provides additional methods and building blocks for implementation.
How to implement information security
1. Define scope and responsibility
Clarify which parts of the organisation, information, systems, locations and suppliers are included. Management remains accountable for direction, resources and risk decisions even when operational tasks are delegated.
2. Identify information and dependencies
Determine which information is needed for critical products, services and obligations. Include suppliers, cloud services, physical records and specialist knowledge, not only central IT systems.
3. Assess risks
Consider threats, vulnerabilities, existing controls and possible business or human impact. Record who owns each risk and how it will be treated, accepted, avoided or transferred.
4. Select and implement controls
Choose controls that address the assessed risks. Assign owners, target dates and evidence. Controls should fit the organisation rather than being copied as an unprioritised checklist.
5. Prepare for incidents and disruption
Define how people report events, how the organisation investigates and contains incidents, how services are restored and how external communication or notification decisions are made.
6. Measure and improve
Review whether controls work. Audits, exercises, security metrics, incidents, changes and management reviews should lead to tracked improvement actions.
What does an information security officer do?
An information security officer or information security manager coordinates the security management process and advises management. Typical responsibilities include maintaining the ISMS, facilitating risk assessments, coordinating policies and awareness, monitoring improvements and preparing management reviews or audits.
The exact role depends on the organisation. There is no general rule requiring every company to appoint an information security officer, and the role is not automatically equivalent to a data protection officer. Sector-specific regulation, customer requirements or the organisation’s governance model may create additional obligations.
An external information security officer can provide independent expertise and coordination when the necessary capacity is not available internally. Responsibility for the organisation’s security decisions remains with management.
Managing information security with ComplianceOS
Information security work often becomes fragmented across spreadsheets, policies, ticketing systems and evidence folders. ComplianceOS helps teams connect programmes such as ISO/IEC 27001 or BSI IT-Grundschutz with controls, risks, measures, responsibilities and evidence.
The software supports the management workflow; it does not replace risk decisions, technical implementation or independent assurance. A discovery call can clarify how existing security documentation and responsibilities could be represented.
Frequently asked questions about information security
Is information security the same as cybersecurity?
No. Cybersecurity focuses on connected digital environments. Information security is broader and also covers non-digital information, physical records and organisational knowledge.
Is ISO/IEC 27001 certification mandatory?
There is no general obligation for every organisation to obtain ISO/IEC 27001 certification. Certification may be required by a contract, procurement process or sector-specific rule. Organisations can implement an ISMS based on the standard without certification.
Who is responsible for information security?
Management is accountable for setting direction, providing resources and accepting risks. An information security officer can coordinate the work, but effective security also depends on process owners, IT, suppliers and every person who handles information.
What should an information security policy contain?
It should state purpose, scope, objectives, responsibilities, core rules, exceptions, enforcement and review arrangements. Supporting policies and procedures then translate that direction into operational requirements.
This article provides general orientation and does not replace a risk assessment or advice for a specific regulatory context.