Information Security Model Canvas (ISMC)
The Information Security Model Canvas is a visual model for considering an information security program. It organizes the elements that shape how security is planned, operated, and improved.
A program-level reference
architecture for information security.
The Information Security Model Canvas serves as a program-level reference architecture to guide the design, implementation, operation, and improvement of information security programs. It provides structure, awareness, and a foundation for collaboration and informed decision-making across the program lifecycle.
Within the TrustHarbor approach, the ISMC is one of several models used to make different aspects of a program visible. It focuses on program structure. Other TrustHarbor models address assessment and how the program operates.
What the ISMC shows
The ISMC presents the elements that make up a complete information security program and how they relate to one another. It is not tied to any specific technology, vendor, or compliance framework. This allows it to remain useful as systems, threats, and requirements change.
A detailed layer shows the program elements in each group.
By considering the program as a system, the model supports more informed use.
How the ISMC is used
In practice, the ISMC is used to support:
- Awareness: a shared view of the entire program
- Orientation: establishing a shared view of the program, showing where specific questions or activities belong
- Examination: identifying missing elements or overlaps
- Collaboration: supporting clearer conversation between stakeholders
- Improvement: informing on how changes in one area may affect others
It provides a common frame of reference for clarity and adapting an information security program.
What the ISMC is not
The ISMC is not:
- A checklist or audit form
- A compliance or certification standard
- A maturity model
- A replacement for technical or operational controls
It is a way to see and reason about the structure of a program so that decisions about security can be made with better context.