ISO 27001 Gap Analysis-Case Study

This work describes the initial steps taken toward the development of an Information Security Management System for the UAE e-government. To achieve this goal it was decided to obtain the ISO 27001 certification, which is the leading standard in information security. Gap analysis was performed on four selected organisations within the UAE e-government to determine their compliance against the ISO 27001 standards. This process will help identify the weakness in the existing system and highlight the any associated risks to the UAE e-government. In this paper a Management, Technical and Operational (MTO) model is presented. This model gives greater focus and provides a framework which is more aligned to the organisations structure and responsibilities. The results of benchmarking based on the ISO27001 standard, and the method used to measure the maturity level for each security control domain are presented.