IT Standardization in the Area of Information Security with a Focus on ISO/IEC 27001

Abstract

Due to the intensive use of information technologies, the protection and security of information have become a key challenge and imperative in the business environment. Threats to information security are constantly growing, and more and more organizations know that poor information security can be "expensive", regardless of whether their or their customers' confidential data is at risk. In this regard, various standards and guidelines for information security have been developed. In this paper, the focus is on the ISO/IEC 27000 family of standards for information security management, more precisely, the most well-known standard for information security and the fourth most widespread ISO standard - ISO/IEC 27001. The paper aims to analyze the current state of standardization in the field of information protection and security through the analysis of available sources of knowledge and to point out the importance of applying the ISO/IEC 27000 family of standards in practice and then use statistical analysis, specifically, using adequate T-test to examine whether the price of the most popular and, in practice, the most applied standard from the ISO/IEC 27000 family, the ISO/IEC 27001 standard, is statistically significantly different from the price of other published standards from the said family.