Managing security related information technology services

A method for managing information technology services, the method comprising:

• determining, by a computer system, a current security assurance level for an information technology service related to security in an organization based on assessment information about a group of security factors for the information technology service and performance information about a group of current security controls for the information technology service;
• determining, by the computer system, a target security assurance level for the information technology service based on assessment information about a criticality of the information technology service;
• displaying, by the computer system, a graphical representation of a difference between the current security assurance level and the target security assurance level on a display system;
• determining, by the computer system, a group of additional security controls that when implemented for the information technology service, result in the difference between the current security assurance level and the target security assurance level being within a desired security assurance level for protecting against an attack on the information technology service;
• and
• displaying, by the computer system when the difference is greater than a threshold, a graphical indication of a group of additional security controls with a group of associated links that, when implemented for the information technology service, results in the difference between the current security assurance level and the target security assurance level being within a desired security assurance level for protecting against the attack on the information technology service and
• initiating implementation of a security control corresponding to a link in the group of associated links via selecting the link.

An information technology service management system that comprises:

• a computer system that comprises an information technology service manager configured to:
• receive assessment information about a criticality and a group of security factors for an information technology service related to security in an organization, such that the assessment information comprises a percentage of time that the information technology service can protect itself when security controls of a network surrounding the information technology service are unavailable;
• determine a current security assurance level for the information technology service based on the assessment information about the group of security factors for the information technology service and performance information about a group of current security controls for the information technology service;
• determine a target security assurance level for the information technology service based on the assessment information about the criticality of the information technology service;
• determine a difference between the current security assurance level and the target security assurance level;
• compare the difference to a threshold for a desired security assurance level that protects against an attack on the information technology service;
• determine a group of additional security controls that when implemented for the information technology service, result in the difference between the current security assurance level and the target security assurance level being within the desired security assurance level for protecting against the attack on the information technology service;
• and
• display, when the difference is greater than the threshold, a graphical indication of a group of additional security controls and a group of associated links that, if implemented for the information technology service, results in the difference between the current security assurance level and the target security assurance level being within the desired security assurance level that protects against the attack on the information technology service, wherein a selection of a link in the group of associated links initiates implementation of a security control that corresponds to the link.