Leia o texto a seguir.
The ITIL security management process describes the structured fitting of security in the management organization. ITIL security man-agement is based on the Code of Practice for Information Security Management defined by ISO/IEC 27002.
A basic concept of security management is the information security. The primary goal of infor-mation security is to guarantee safety of infor-mation. When protecting information it is the value of the information that has to be protected. These values are stipulated by the confidential-ity, integrity and availability. Inferred aspects are privacy, anonymity and verifiability.
The goal of the Security Management is split up in two parts: 1 - The realization of the security requirements defined in the service level agreement (SL(A) and other external requirements which are specified in underpinning contracts, legislation and possible internal or external imposed policies.
2 - The realization of a basic level of security. This is necessary to guarantee the continuity of the management organization. This is also nec-essary in order to reach a simplified service-level management for the information security, as it happens to be easier to manage a limited number of SLAs as it is to manage a large number of SLAs.
The input of the security management process is formed by the SLAs with the specified security requirements, legislation documents (if applicable) and other (external) underpinning contracts. These requirements can also act as key per-formance indicators (KPIs) which can be used 20 for the process management and for the justification of the results of the security management process.
The output gives justification information to the realization of the SLAs and a report with devia-tions from the requirements.
The security management process has relations with almost all other ITIL-processes. However, in this particular section the most obvious relations will be the relations to the service level man-agement process, the incident management process and the Change Management process.