  In this paper we present an approach for specifying and prioritizing
information security requirements in organizations. It is important to
prioritize security requirements since hundred per cent security is not
achievable and the limited resources available should be directed to satisfy
the most important ones. We propose to link explicitly security requirements
with the organization's business vision, i.e. to provide business rationale for
security requirements. The rationale is then used as a basis for comparing the
importance of different security requirements. A conceptual framework is
presented, where the relationships between business vision, critical impact
factors and valuable assets (together with their security requirements) are
shown.
