從資訊單位流程改造觀點探討導入ISO27001—以某商業銀行為例

金融機構為取得主管機關及客戶之信任，達到資訊系統安全的機密性、完整性與可用性而導入國際ISO27001認證，實務上為申請及維持ISO認證，公司需投入大量的人力及軟、硬體成本，但導入ISO27001過程「如何讓資訊單位及整體組織影響衝擊最小，績效表現最佳？」為本研究之動機。本研究的目的有三項：1、導入ISO27001後，安全控管流程的改變對資訊單位之影響為何。2、從訪談記錄中歸納分析導入ISO27001後，流程改造之成效為何。3、提升導入ISO27001整體組織績效表現的關鍵因子為何。本研究採用深度訪談法，透過某商業銀行之實施過程，與參與人員進行訪談、觀察與分析其訪談結果，瞭解整個推導ISO27001流程改造前、後整個過程，分析流程改造後對績效的影響，找出提升績效表現的關鍵因子。歸納本研究之結果，主要發現個案資訊處流程改造重要的影響因子如下：一、PDCA：組織的流程改造是無法一步到位，需不斷改善調整循序漸進。二、80/20原則：本個案廣泛的運用此原則，針對欲改善之流程瓶頸點收集相關資訊，找出產生80%問題的核心原因，進行系統或流程的優化。三、資源整合：統一硬體的規格、資料庫集中管理、與跨單位合作資源整合應用，解決環境、設備之差異化可能帶來的衍生問題。四、垂直整合：上、下游的垂直整合，讓整體維運的優化更精進，流程設計更順暢，以自動化科技建置一條龍工作服務。五、KPI：在流程改造過程中為使同仁對改造目標一致，設計之量化、質化KPI，能夠成為流程改造弱點的補強力道。這些關鍵因子相互配合、支援讓資訊處策略推動發揮更好的成效。

關鍵字

ISO ；流程改造(Business Process Reenginering) ；資訊安全(information security)

並列摘要

The ISO 270001 Authentication is applied for the purpose of establishing trust from competent authorities and customers and maintaining the confidentiality, integrity and availability of Information System Security. As a matter of fact, the application and maintenance of ISO authentication require a huge amount of manpower, software and hardware cost. The motivation of research herein is probing into the method to minimize the impacts and optimize the performance within information units and overall organization when adopting ISO27001. There are three purposes for this research: firstly, discussing the impacts the security control process alteration exerting on the information units after adopting ISO27001; secondly, probing into the effectiveness of process reengineering after adopting ISO27001 by referring to, concluding and analyzing the interviews; thirdly, exploring the key factors for improving the overall organizational performance after adopting ISO27001. This research understands the whole processes of ISO27001, either before or after process reengineering, analyses the effects on performance after process reengineering as well as finds out the key factors for improving performance by the application of in-depth interview, referring to the implementary processes by commercial banks, carrying out interviews for participants as well as observing and analyzing the interviews. According to the results herein concluded, there are several important impact factors for case information process reengineering: 1. PDCA: the organizational process reengineering is incapable of putting in place once for all, which requires constant improvement, adjustment and progressive efforts. 2. 80/20 Principle: this principle is prevailing in this case, more specifically, collecting relevant information for bottlenecks of processes to be ameliorated, finding out the core reasons resulting in 80% of problems and optimizing the system or processes. 3. Resources integration: uniforming the specifications of hardware, centralizing management of database, establishing cross-unit partnerships, resources integration as well as application and solve potential problems deriving from environmental and equipment differences. 4. Vertical integration: the vertical integration of upstream and downstream enables the overall operational optimization more sophisticated and the process designs more fluent to form an all-in-one services by automated sciences and technologies. 5. KPI: the quantitative and qualitative KPI is designed for uniforming the reengineering goals of staff during process reengineering and serving for transforming the vulnerabilities existing in process reengineering. The interactions, supports from these key factors make it possible for Information Department to better promote the strategies and achieve better results.