Abstract
The practices of the ISO 17799:2000 standard include organizational security, personnel security, physical and environmental security, communications and operations management, and system development and maintenance. Each section provides insight into how security is maintained by having them implemented into the information security policy. Having these implemented helps the organization in various ways and provide the sense of security to themselves. The business executives have been questioning as to why there has been an increased spending in security. The spending has gone beyond the set IT budget and the executives want answers as to what they are getting out. The best way to justify the spending is by looking at five security recommendations comprised with the best practices in information security. These practices are comprised in the ISO 17799:2000 standard. The five sections that will be presented are organizational security, personnel security, physical and environmental security, communications and operations management, and system development and maintenance. If employees’ comply with these practices, the organization themselves will be able balance spending and cut losses. The first type of practice that is included in an information security policy is organizational security. The focus of organizational security is the “establishing and supporting a management framework to implement and manage information security within, across, and outside the organization” (Greene, 2006, p. 79). There are two factors that the security infrastructure control needs to consider. These factors are called inward facing and outward facing. Inward facing is defined when policies and controls are focused towards the employees’ and stakeholders’ relationship information systems. Outward facing focus on the third-party, the policies and controls are focused