THE STATUS OF INFORMATION SECURITY MANAGEMENT PERFORMANCE IN LIBRARIES OF STATE MEDICAL SCIENCES UNIVERSITIES IN TEHRAN BASED ON ISO/IEC 27002 STANDARDS

Introduction ISO/IEC 27002 standard is considered in the area of information security management. Its characteristics has made it applicable in various organizations and applied fields. In this study the status of information security management performance was examined in the Libraries of State Medical Sciences Universities in Tehran based on ISO/IEC 27002. Methods: In this study that is an applied research and its method is descriptive/ analytical, all of the senior and intermediate managers in the libraries of state medical sciences Universities in Tehran cosist the research population. 50 managers participated in the current study. The data were collected with the questionnaire. Results: With regard to the 11 indexes for observing the ISO/IEC 27002, the results revealed the following mean values: security policy (2/54), organization of information security (2/58), asset management (1/97), human resources security (2/61), physical and environmental security (2/33), communications and operations management (2/51), access control (2/43), information systems acquisition, development and maintenance (2/64), information security incident management (2/68), business continuity management (2/66), compliance (2/49). According to the evaluation table, the mean values of all the indexes had a somehow optimal level and only one index “asset security management” was in non-optimal status. Conclusion: Considering the results, one might conclude that the studied libraries have a somehow optimal status of information security management. No study has yet been conducted regarding the information security management according to international standards in the libraries of medical sciences Universities in Iran. Keywords: Information Security, Information Security Management, ISO/IEC27002 Standard