Eureka! Institutional Repository

Information security is a very important part in the management of a modern organization. The evolving technologies in the process of handling, processing and storing information leads to increased vulnerabilities and associated risks. Addressing threats in an integrated and organized way is now imperative for an organization that wants to maintain its credibility. The establishment of an Information Security Management System (ISMS) provides the framework for creating, implementing, managing and maintaining a security program. Additionally, compliance with a security standard such as ISO 27001 contributes to proper risk management. In the present study, the concept of ontologies is introduced and their use is applied to security screening. The analytical presentation of ISO 27001 clarifies the requirements of the standard and how it is captured in an ontology. In addition, the security ontologies and the General Data Protection Regulation are presented. The aim of this thesis is to analyze the process of acquiring and maintaining ISO 27001 certification using ontologies. This approach is presented through the needs of a small-sized business as an example of an illustrative study case.