The Standard of Good Practice for Information Security is designed to help any organisation, irrespective of market sector, size or structure, keep the business risks associated with its information systems within acceptable limits. It is a major tool in improving the quality and efficiency of security controls applied by an organisation. Updated January 2005