IMPLEMENTATION OF INFORMATION SECURITY MANAGEMENT SYSTEM IN A MANUFACTURING COMPANY

Magistrska naloga obravnava vzpostavitev sistema za upravljanje informacijske varnosti (SUIV) v proizvodnem podjetju, pri čemer se osredotoča na 1. fazo Demingovega kroga – načrtovanje vzpostavitve SUIV. Sestavljena je iz dveh delov. V prvem delu so podane teoretične osnove s področja informacijske varnosti. Prikazana je zasnova modela načrtovanja SUIV s pomočjo smernic, ki jih podaja standard ISO/IEC 27003. V drugem, praktičnem delu je predstavljeno podjetje Vega International d.o.o. Opisano je obstoječe stanja s stališča informacijske varnosti. V nadaljevanju je zasnovani teoretični model apliciran v obravnavano podjetje. Aplikacija modela vključuje pridobitev odobritve vodstva za začetek projekta, definiranje obsega SUIV, njegovih omejitev in politike SUIV, analizo stanja, oceno tveganja, ravnanje ob tveganju, dokumentiran SUIV in izdelavo končnega načrta projekta SUIV. Za zaključek so predstavljene še ostale tri faze vzpostavitve SUIV (uvedba, kontroliranje in korigiranje), ki so mišljene kot priporočilo in perspektive za nadaljnje delo v podjetju.The master\u27s thesis deals with an establishment of information security management system (ISMS) in a manufacturing company, focusing on the first phase of the Deming circle - planning the establishment of ISMS. The thesis consists of two parts. The first one describes the theoretical bases of the information security. The model of ISMS implementation which is shown is based on the guidance provided in the ISO / IEC 27003 standard. In the second, practical part, the company Vega International d.o.o. is presented including the description of the status quo in terms of information security. Then, the theoretical model of ISMS is applied to the discussed company. Application of the model includes: obtaining the approval of the management for the project, defining the scope of ISMS, its limitations and policy, situation analysis, risk assessment, dealing with the risk, documented ISMS and making the final project plan of ISMS. To conclude, we present the remaining three phases of establishing ISMS (DO, CHECK and ACT), which are intended as a reference and perspectives for further work in the company