Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →ISACA’s Business Model for Information Security (BMIS) is a model for understanding how information security relates to an organisation’s goals, people, processes and technology. It helps business and security teams examine those parts as an interconnected system. BMIS is a way to frame analysis and discussion—not a security standard, certification or ready-made checklist.
Why did ISACA issue the Business Model for Information Security?
ISACA presented BMIS as a holistic way to design, implement and manage information security by looking at the enterprise system rather than addressing apparent security symptoms in isolation. The 2010 announcement described it as vendor- and technology-neutral, intended for use across industries and countries, and complementary to other security frameworks. Those are the announcement’s stated aims, not a guarantee that the model will fit every organisation without adaptation. SecurityWeek’s report, published 7 October 2010, covered the publication that week. ISACA’s guide says the model had been introduced to the security community in January 2009, so the two dates refer to different milestones.
As an Amazon Associate I earn from qualifying purchases.
The business connection is central: security is not only about protecting information, but also about enabling the organisation to meet its objectives. ISACA’s 2010 guide puts it this way: “The security programme exists not only to protect business information, but also—and primarily—to support the business in reaching its objectives.”
What are the elements of BMIS?
ISACA describes BMIS as a three-dimensional model with four elements and six dynamic interconnections. The elements identify areas to examine; the interconnections draw attention to how those areas influence one another. ISACA’s glossary describes BMIS as a common language for security professionals and business management to consider information security in relation to enterprise governance and objectives.
#1 Best Overall
| Element | What it covers |
|---|---|
| Organisation | Enterprise design, strategy, governance, roles and the structure in which security operates. |
| Process | Activities and business processes that security enables or affects. |
| People | Individuals and groups, including their roles, behaviour, skills and interactions. |
| Technology | The technical applications and systems used in the enterprise. |
What do BMIS’s six interconnections mean?
The interconnections are named Governing, Culture, Architecture, Enabling and Support, Human Factors, and Emergence. They prompt teams to consider relationships across the four elements instead of treating each as a separate security workstream.
- Governing: how governance and organisational direction shape security.
- Culture: how shared norms and behaviours influence security practice.
- Architecture: how organisational and technical structures fit together.
- Enabling and Support: how people, processes and technology support security and business activity.
- Human Factors: how people’s capabilities and behaviour affect security outcomes.
- Emergence: how interactions across the system can produce effects that are not apparent when each element is considered alone.
These brief descriptions explain the role of each connection in the model; they are not a set of controls prescribed by BMIS. ISACA’s later discussion of risk transformation also names the four elements and six interconnections. The ISACA Journal article, published 1 May 2019, applies BMIS to identifying levers for change and considering an organisation’s current state before deciding which capabilities to enhance.
How can an organisation use BMIS?
Use BMIS to structure a conversation or assessment about how security arrangements relate to business goals. For example, when a team proposes a technical control, the model can help it ask whether governance supports the change, whether affected processes will work differently, and whether people have the roles and skills to use it. That kind of analysis can expose dependencies that a technology-only view might miss.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Start with the business objective. State what the organisation needs to achieve or protect, rather than beginning with a tool or isolated control.
- Map the relevant elements. Identify the organisational arrangements, processes, people and technology involved.
- Trace the connections. Consider governance, culture, architecture, support, human factors and possible system-wide effects.
- Identify changes or gaps. Decide which capabilities or relationships need attention and who should be involved.
- Choose implementation guidance separately. Use applicable standards and frameworks to define requirements, controls or implementation steps.
BMIS can help security practitioners explain why a project matters to the business, but it does not by itself specify a complete transformation method or establish that a particular control is adequate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is BMIS a standard, framework or certification?
BMIS is primarily a model: it offers a way to understand and discuss information security in an enterprise context. ISACA’s 2010 announcement and guide say it should be supported by standards and frameworks. A model helps frame the questions and relationships to examine; standards or frameworks can provide more specific requirements or implementation guidance. BMIS is not itself a certification or a plug-and-play compliance checklist.
In SecurityWeek’s 2010 report, then-ISACA international vice president Rolf von Roessing described BMIS as a practical tool for connecting security projects with business strategy. That captures its intended role: to support alignment and analysis, not to replace the detailed work of selecting and implementing security measures.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
