# Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal
## 2 Literature Review
### Standard ISO-27001:2013  
ISO-27001:2013 [24] is an international standard that defines a list of controls that are to be considered in the implementation of an Information Security Management Systems (ISMS) [25]. Because organisations of all types and sizes collect, process, store, and transmit data and information, electronically, physically, and verbally, the standard was designed to be used as a reference and a proposal of best practices, when implementing an ISMS in a wide set of scenarios and businesses.  
The ISO-27001:2013 standard [24] defines 114 controls, grouped into 14 thematic categories. Each control is analysed, and a score is assigned, according to its level of conformity. A control can be in three distinct states: fail, pass, or not applicable. A control that fails means that it has a level of conformity of 0%. A control that passes means that it is accepted with an acceptance level above 0%, which should be the highest possible. The control may also not be applicable to the enterprise being audited, as it is not relevant in the scope of its activity or organisation.  
The project memorandum also defined two distinct auditing types to be considered within the scope of the project, namely \"Type 1\" and \"Type 2\". Although both types are detailed in Section 3, a general definition is as follows. Type 1 auditing, which is also termed \"Standard\", is composed of subset of 30 controls and only these will be analysed and mitigated. In the Type 2 auditing, also named as \"Full\", all of the 114 controls are going to be analysed and those that did not pass are mitigated. Table 1 shows the list of categories considered in each auditing typology of the project.  
\begin{table}
\begin{tabular}{l c c} \hline \hline
**Categories** & **Type 1—Standard** & **Type 2—Full** \\ \hline (A.5) Information security policies & X & X \\ (A.6) Organization of information security. & X \\ (A.7) Human resource security & X \\ (A.8) Asset management & X & X \\ (A.9) Access control & X & X \\ (A.10) Cryptography & X & X \\ (A.11) Physical and environmental security & X & X \\ (A.12) Operations security & X & X \\ (A.13) Communications security & X & X \\ (A.14) System acquisition, development and maintenance & X & X \\ (A.15) Supplier relationships & X & X \\ (A.16) Information security incident management & X \\ (A.17) Information security aspects of BCM & X & X \\ (A.18) Compliance & X & X \\ \hline \hline \end{tabular}
\end{table}
Table 1: Identification of the categories considered to “Type 1” and “Type 2” auditing.  
Information security is addressed inside an organisation when cybersecurity challenges emerge and, therefore, a set of procedures is defined to answer to controls demands, namely policies, processes, procedures, organisation structures, software, and hardware functions. By establishing, implementing, and monitoring these controls, a higher level of awareness toward the importance of security and business objectives of the organisation are met.  
The ISO-27001:2013 belongs to a family of Information Security Standards. One of the core concepts of ISO-27001 is to identify information security risk and to further apply the appropriate controls that can evaluate and mitigate the risk. Under this family of standards, the ISO-27005 [26] describes risk management methods. Interrelated to cybersecurity, the ISO-27037 [27] defines guidelines that are related to security techniques that may identify, collect, acquire, and preserve a digital evidence.