IT governance Book

	Foreword
	The information economy	2
	What is IT governance?	3
	Information security	4
1	Why is information security necessary?	9
2	The combined code, the Turnbull report and Sarbanes-Oxley	23
3	BS 7799	33
4	Organizing information security	49
5	Information security policy and scope	69
6	The risk assessment and statement of applicability	79
7	External parties	99
8	Asset management	111
9	Human resources security	127
10	Physical and environmental security	143
11	Equipment security	153
12	Communications and operations management	163
13	Controls against malicious software (malware) and back-ups	177
14	Network security management and media handling	189
15	Exchanges of information	195
16	Electronic commerce services	203
17	E-mail and Internet use	213
18	Access control	221
19	Network access control	239
20	Operating system access control	251
21	Application access control and teleworking	257
22	Systems acquisition, development and maintenance	265
23	Cryptographic controls	271
24	Security in development and support processes	279
25	Monitoring and information security incident management	287
26	Business continuity management	303
27	Compliance	315
28	The BS 7799 audit	337
App. I	Useful websites	345
App. II	ISO/IEC 17799:2005	353