Information Security Forum

Information Security Forum
Name	Information Security Forum
Formation	1989
Type	Non-profit
Headquarters	London
Region served	International
Membership	Corporations, financial institutions, government agencies
Leader title	Chief Executive

Information Security Forum The Information Security Forum is an independent, international non-profit organization providing research and guidance on information risk, cybersecurity, and resilience for large corporations, banks, insurance companys, and telecommunications firms. It produces risk assessment methodologies, best practice guidance, and threat intelligence to support boards, chief executive officers, chief information officers, chief information security officers, and security teams across sectors including finance, healthcare, energy industry, and retail industry. The organization collaborates with standards bodies, regulators, and industry consortia such as International Organization for Standardization, National Institute of Standards and Technology, European Union Agency for Cybersecurity, and Financial Stability Board.

Overview

The Forum offers research, tools, and frameworks addressing strategic concerns like cyber resilience, third-party risk, cloud security, identity and access management, and operational technology protection for sectors such as banking, insurance companys, telecommunications, utilities, and manufacturing. Its outputs inform corporate governance, risk committees, audit committees, and incident response teams operating within jurisdictions influenced by UK Financial Conduct Authority, US Securities and Exchange Commission, European Central Bank, and Monetary Authority of Singapore. The organization engages with professional bodies including ISACA, (ISC)², Institute of Risk Management, and Chartered Institute of Information Security to align practice across certifications like Certified Information Systems Security Professional and Certified Information Security Manager.

History

Founded in 1989 by a group of senior information security practitioners from multinational banks and insurance companys, the Forum emerged amid rising computerization in the 1980s and concerns following incidents such as the Morris worm. Early membership included firms with operations across the United Kingdom, United States, Japan, and Germany. Over time the Forum expanded research topics to include cyber threat intelligence following events like the Stuxnet operation, supply chain attacks highlighted by Target data breach (2013), and state-sponsored intrusions exemplified by NotPetya. Its evolution tracked parallel developments at International Organization for Standardization and National Institute of Standards and Technology, and it has been cited in regulatory discussions involving the European Commission and central banks such as the Bank of England.

Governance and Membership

The Forum is governed by a board comprising senior executives and security leaders drawn from founding and strategic member organizations including global banks, insurance companys, pharmaceutical companys, and energy companys. Membership tiers span strategic members, principal members, and associate members representing sectors regulated by entities like the Financial Conduct Authority, Office of the Comptroller of the Currency, and European Banking Authority. The leadership interacts with advisory panels featuring experts from National Cyber Security Centre (United Kingdom), Cybersecurity and Infrastructure Security Agency, and academic institutions such as University of Oxford, Massachusetts Institute of Technology, and Stanford University.

Activities and Publications

The Forum publishes white papers, toolkits, threat briefings, and maturity assessments addressing topics such as cyber resilience, third-party risk, cloud migration, privacy impact, and incident response for stakeholders including board of directors and risk committees. Notable outputs have paralleled standards discussions at International Organization for Standardization (for example, ISO/IEC standards), and have been used in audits by firms subject to Sarbanes–Oxley Act and General Data Protection Regulation compliance efforts. The Forum runs workshops, tabletop exercises, and peer networking events alongside collaborations with consortia like World Economic Forum and Financial Action Task Force. It also issues advisory guidance in response to major incidents such as WannaCry ransomware attack and provides scenario analyses reflecting geopolitical tensions involving Russia, China, and North Atlantic Treaty Organization considerations.

Standards, Frameworks, and Best Practices

The Forum develops frameworks and best-practice methodologies that map to ISO/IEC standards and NIST frameworks, offering controls and implementation guidance for domains including identity, access, cryptography, and incident management. Its Good Practice Guides and threat taxonomies have been referenced alongside frameworks such as the NIST Cybersecurity Framework, ISO/IEC 27001, and COBIT in corporate governance and regulatory compliance programs overseen by bodies like the European Banking Authority and Financial Conduct Authority. The Forum's work also informs certification programs affiliated with ISACA and (ISC)² and aligns with international initiatives such as the Budapest Convention on Cybercrime and sector-specific guidance from Financial Stability Board.

Impact and Criticism

The Forum has influenced corporate security strategies across multinational banks, insurance companys, utility providers, and technology companys, contributing to improved board-level awareness and integration of cyber risk into enterprise risk management frameworks used by firms reporting to regulators such as the US Securities and Exchange Commission and Prudential Regulation Authority. Critics note potential limitations including membership-driven priorities favoring large multinational corporations, relative opacity in governance compared with public standards bodies like International Organization for Standardization, and challenges in addressing emerging threats originating from non-state actors linked to incidents like SolarWinds supply chain attack. Debates persist about balancing proprietary member services with open-access guidance promoted by organizations such as European Union Agency for Cybersecurity and National Institute of Standards and Technology.

Category:Information security organizations Category:Non-profit organisations based in the United Kingdom