{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T22:50:53Z","timestamp":1780527053086,"version":"3.54.1"},"publisher-location":"Cham","reference-count":38,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319074511","type":"print"},{"value":"9783319074528","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2014]]},"DOI":"10.1007\/978-3-319-07452-8_1","type":"book-chapter","created":{"date-parts":[[2014,5,22]],"date-time":"2014-05-22T01:53:43Z","timestamp":1400723623000},"page":"1-34","source":"Crossref","is-referenced-by-count":14,"title":["A Structured Comparison of Security Standards"],"prefix":"10.1007","author":[{"given":"Kristian","family":"Beckers","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Isabelle","family":"C\u00f4t\u00e9","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Stefan","family":"Fenz","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Denis","family":"Hatebur","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Maritta","family":"Heisel","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"1_CR1","unstructured":"International Organization for Standardization (ISO), International Electrotechnical Commission (IEC): Information technology - Security techniques - Information security management systems - Requirements (2005)"},{"key":"1_CR2","unstructured":"ISO\/IEC: Common Criteria for Information Technology Security Evaluation. ISO\/IEC 15408, International Organization for Standardization (ISO) and International Electrotechnical Commission, IEC (2012)"},{"key":"1_CR3","unstructured":"ISO\/IEC: Risk management Principles and guidelines. ISO\/IEC 31000, International Organization for Standardization (ISO) and International Electrotechnical Commission, IEC (2009)"},{"key":"1_CR4","doi-asserted-by":"crossref","unstructured":"Sunyaev, A.: Health-Care Telematics in Germany - Design and Application of a Security Analysis Method. Gabler (2011)","DOI":"10.1007\/978-3-8349-6519-6"},{"key":"1_CR5","unstructured":"Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI): Standard 100-3 Risk Analysis based on IT-Grundschutz, Version 2.5 (2008)"},{"key":"1_CR6","unstructured":"JASON: Science of Cyber-Security. Technical report, The MITRE Corporation, JSR-10-102 (2010)"},{"key":"1_CR7","doi-asserted-by":"crossref","unstructured":"Stoneburner, G., Goguen, A., Feringa, A.: Risk management guide for information technology systems. NIST Special Publication 800-30, National Institute of Standards and Technology (NIST), Gaithersburg, MD 20899-8930 (July 2002)","DOI":"10.6028\/NIST.SP.800-30"},{"key":"1_CR8","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/978-3-642-32498-7_1","volume-title":"Multidisciplinary Research and Practice for Information Systems","author":"K. Beckers","year":"2012","unstructured":"Beckers, K., Eicker, S., Fa\u00dfbender, S., Heisel, M., Schmidt, H., Schwittek, W.: Ontology-based identification of research gaps and immature research areas. In: Quirchmayr, G., Basl, J., You, I., Xu, L., Weippl, E. (eds.) CD-ARES 2012. LNCS, vol.\u00a07465, pp. 1\u201316. Springer, Heidelberg (2012)"},{"issue":"1","key":"1_CR9","first-page":"7","volume":"15","author":"B. Fabian","year":"2010","unstructured":"Fabian, B., G\u00fcrses, S., Heisel, M., Santen, T., Schmidt, H.: A comparison of security requirements engineering methods. Requirements Engineering \u2013 Special Issue on Security Requirements Engineering\u00a015(1), 7\u201340 (2010)","journal-title":"Requirements Engineering \u2013 Special Issue on Security Requirements Engineering"},{"key":"1_CR10","unstructured":"Jackson, M.: Problem Frames. Analyzing and structuring software development problems. Addison-Wesley (2001)"},{"key":"1_CR11","unstructured":"Gollmann, D.: Computer Security, 2nd edn. John Wiley & Sons (2005)"},{"key":"1_CR12","unstructured":"Bishop, M.: Computer Security: Art and science, 1st edn. Pearson (2003)"},{"key":"1_CR13","unstructured":"Viega, J., McGraw, G.: Building secure software: How to avoid security problems the right way, 1st edn. Addison-Wesley (2001)"},{"key":"1_CR14","doi-asserted-by":"crossref","unstructured":"Firesmith, D.: Common concepts underlying safety, security, and survivability engineering. Technical report sei-2003-tn-033, Carnegie Melon University (2003)","DOI":"10.21236\/ADA421683"},{"key":"1_CR15","unstructured":"ISO\/FDIS: ISO\/IEC 27799:2007(E), Health Informatics - Information Security Management in health using ISO\/IEC 27002 (November 2007)"},{"key":"1_CR16","unstructured":"Stallinger, M.: CRISAM - Coporate Risk Application Method - Summary V2.0 (2004)"},{"issue":"10","key":"1_CR17","doi-asserted-by":"publisher","first-page":"21","DOI":"10.1016\/0167-4048(91)90051-E","volume":"10","author":"B. Farquhar","year":"1991","unstructured":"Farquhar, B.: One approach to risk assessment. Computers and Security\u00a010(10), 21\u201323 (1991)","journal-title":"Computers and Security"},{"issue":"2","key":"1_CR18","doi-asserted-by":"publisher","first-page":"147","DOI":"10.1016\/j.cose.2004.07.004","volume":"24","author":"B. Karabacak","year":"2005","unstructured":"Karabacak, B., Sogukpinar, I.: Isram: Information security risk analysis method. Computers & Security\u00a024(2), 147\u2013159 (2005)","journal-title":"Computers & Security"},{"key":"1_CR19","unstructured":"Japan Information Processing Development Corporation and The Medical Information System Development Center: ISMS User\u2019s Guide for Medical Organizations (2004)"},{"key":"1_CR20","unstructured":"Standards Australia International; Standards New Zealand: Guidelines for managing risk in healthcare sector: Australian\/ New Zealand handbook, Standards Australian International (2001)"},{"key":"1_CR21","unstructured":"Food and Drug Administration: Guideline for Industry, Q9 Quality Risk Management (2006); In US Department of Health and Human Services"},{"key":"1_CR22","unstructured":"ISO\/IEC: ISO\/IEC 27005: 2007, Information technology - Security techniques - Information security risk management (November 2007)"},{"key":"1_CR23","unstructured":"DCSSI: Expression des Besoins et Identification des Objectifs de Scurit (EBIOS) - Section 2 - Approach. General Secretariat of National Defence Central Information Systems Security Division (DCSSI) (February 2004)"},{"key":"1_CR24","doi-asserted-by":"crossref","unstructured":"Sharp, H., Finkelstein, A., Galal, G.: Stakeholder identification in the requirements engineering process. In: DEXA Workshop, pp. 387\u2013391 (1999)","DOI":"10.1109\/DEXA.1999.795198"},{"key":"1_CR25","unstructured":"Pouloudi, A.: Aspects of the stakeholder concept and their implications for information systems development. In: HICSS (1999)"},{"key":"1_CR26","unstructured":"Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI): Standard 100-1 Information Security Management Systems (ISMS), Version 1.5 (2008)"},{"key":"1_CR27","unstructured":"BSI: IT-Grundschutz-Vorgehensweise. BSI standard 100-2, Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI) (2008)"},{"key":"1_CR28","unstructured":"BSI: BSI Standard 100-4 Business Continuity Management, Version 1.0. BSI standard 100-4, Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI) (2009)"},{"key":"1_CR29","unstructured":"BSI: Protection Profile for the Gateway of a Smart Metering System (Gateway PP). Version 01.01.01 (final draft), Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI) - Federal Office for Information Security Germany, Bonn, Germany (2011), \n                  \n                    https:\/\/www.bsi.bund.de\/SharedDocs\/Downloads\/DE\/BSI\/SmartMeter\/PP-SmartMeter.pdf?__blob=publicationFile"},{"key":"1_CR30","doi-asserted-by":"crossref","unstructured":"Schwittek, W., Schmidt, H., Eicker, S., Heisel, M.: Towards a Common Body of Knowledge for Engineering Secure Software and Services. In: Proceedings of the International Conference on Knowledge Management and Information Sharing (KMIS), pp. 369\u2013374. SciTePress - Science and Technology Publications (2011)","DOI":"10.1109\/ARES.2012.31"},{"key":"1_CR31","unstructured":"U.S. Department of Energy: A comparison of cross-sector cyber security standards. Technical report, Idaho National Laboratory (2005)"},{"issue":"5","key":"1_CR32","doi-asserted-by":"publisher","first-page":"267","DOI":"10.1016\/j.im.2008.12.007","volume":"46","author":"M. Siponen","year":"2009","unstructured":"Siponen, M., Willison, R.: Information security management standards: Problems and solutions. Inf. Manage\u00a046(5), 267\u2013270 (2009)","journal-title":"Inf. Manage"},{"key":"1_CR33","doi-asserted-by":"crossref","unstructured":"Sommestad, T., Ericsson, G., Nordlander, J.: Scada system cyber security: A comparison of standards. In: 2010 IEEE Power and Energy Society General Meeting, pp. 1\u20138 (July 2010)","DOI":"10.1109\/PES.2010.5590215"},{"issue":"6","key":"1_CR34","doi-asserted-by":"publisher","first-page":"85","DOI":"10.1109\/MSP.2005.157","volume":"3","author":"T. Phillips","year":"2005","unstructured":"Phillips, T., Karygiannis, T., Kuhn, R.: Security standards for the rfid market. IEEE Security Privacy\u00a03(6), 85\u201389 (2005)","journal-title":"IEEE Security Privacy"},{"key":"1_CR35","unstructured":"Kuligowski, C.: Comparison of IT Security Standards. Technical report (2009), \n                  \n                    http:\/\/www.federalcybersecurity.org\/CourseFiles\/WhitePapers\/ISOvNIST.pdf"},{"key":"1_CR36","unstructured":"NIST: A Comparison of the Security Requirements For Cryptographic Modules In FIPS 140-1 and FIPS 140-2. Nist special publication 800-29, National Institute of Standards and Technology (NIST), Gaithersburg, United States (2001) \n                  \n                    http:\/\/csrc.nist.gov\/publications\/nistpubs\/800-29\/sp800-29.pdf"},{"key":"1_CR37","unstructured":"HKSAR: An Overview of Information Security Standards. Technical report, The Government of the Hong Kong Special Administrative Region (HKSAR), Hong Kong, China (2008), \n                  \n                    http:\/\/www.infosec.gov.hk\/english\/technical\/files\/overview.pdf"},{"key":"1_CR38","unstructured":"Arora, V.: Comparing different information security standards: COBIT vs. ISO 27001. Technical report, Carnegie Mellon University, Qatar, United States (2010), \n                  \n                    http:\/\/qatar.cmu.edu\/media\/assets\/CPUCIS2010-1.pdf"}],"container-title":["Lecture Notes in Computer Science","Engineering Secure Future Internet Services and Systems"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-07452-8_1","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,26]],"date-time":"2019-05-26T22:12:40Z","timestamp":1558908760000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-07452-8_1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014]]},"ISBN":["9783319074511","9783319074528"],"references-count":38,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-07452-8_1","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014]]}}}