Security has become one of the most urgent issues for many organizations. It is an essential requirement for doing business in a globally networked economy and for achieving organizational goals and mission. But it is no small task. The technical and environmental complexity of today's organizations and the ever-increasing dependence on technology to drive and automate processes and create competitive advantages make security a challenging activity. Adding to this complexity is a growing list of vulnerabilities and increasingly sophisticated threats to which organizations are subjected on a daily basis.
Organizations can no longer be effective in managing security from the technical sidelines. Security lives in an organizational and operational context, and thus cannot be managed effectively as a stand-alone discipline. Because security is a business problem, the organization must activate, coordinate, deploy, and direct many of its existing core competencies to work together to provide effective solutions. And to sustain success, security at an enterprise level requires that the organization move toward a security management process that is strategic, systematic, and repeatable-in other words, efficient at using security resources and effective at meeting security goals on a consistent basis. Managing for enterprise security defines a disciplined and structured means for realizing these objectives.
