HISACA

Company Profile $-$ PharmUniverse

International pharmaceutical company with $1,500$ employees

Founded nine years ago, headquartered in Boston, Massachusetts, 'USA

Small offices in Los Angeles, California, USA; D$$sseldorf$,$ Germany, and Singapore

Is the result of the work of a senior researcher in the pharmaceutical industry who discovered a new formula for a drug shown to greatly reduce the likelihood of lung and other blood clots

Currently has an eight percent share in the blood clot prevention drug market

$7$

Background Information $-$ Financials

Has grown from an upstart, small$-$scope operation to a

Financials

company with revenue of nearly US $$500$ million in $2012$ and with operating reserves of approximately US $$20$ million

Org. Structure

Market share increased sales volume in dollars by the end of

Marketing

last year, and the goal this year is to increase market share to $10$ percent

Industry

Was privately held from its inception until $2009,$ when it went public with a stock share strike price of US $$7$ per share on the NASDAQ Stock Exchange. The stock has risen to approximately US $$15$ per share and is paying a six percent annual dividend.

$11$

tISACA

Background Information $-$ Org. Structure

What we do

Financials

Org. Structure

Marketing

Industry

Background Information $-$ Industry

What we do

Financials

Org. Structure

Marketing

Industry

Industry

$(1)2013$ ISACA. All nghte resened.

The pharmaceutical industry is extremely competitive. The ability to streamline the process of inventing formulas and testing them to determine whether they are viable as products is what makes a company in this arena successful.

Industrial espionage is common in the pharmaceutical Industry. Obtaining competitors' drug formulas before products go to market is a huge advantage for competitors because it greatly reduces the time and resources needed in the costly research process.

At the same time, having a formula stolen is a worst$-$case scenario for a pharmaceutical company. The company's profits from a new product are likely to be minimised.

$17$

TISACA

The Problems

You are faced with the challenge of establishing an information security governance programme in a company that is relatively new and has never had more than a very small IT security function that focused mostly on firewalls and intrusion prevention systems $($IPSs$)$ before you arrived.

With the exception of you, no one on the executive management team knows much about information security, and although your current budget adequately covers the salaries of your security team and a few network security initiatives that were started before you arrived, the CEO has told you that he has a 'wait and see' attitude towards information security.

Background Information $-$ Org. Structure

What we do

Financials

Org. Structure

Marketing

Industry

The Rescarch team:

The team manager reports to the vice president $($VP$)$ of research, who reports to the CEO. The team is accountable for meeting a long list of objectives, of which the most critical are the number of:

Patents filed and granted per year

Hours of labor to produce a viable formula for each drue product

Viable formulas $($regardless of whether they are patented$)$ created per year

Marketing and sales of products are handled completely independently of the research team.

C $2013$ ISACA. AII rights regived.

$15$

$+$ISACA

Background Information $-$ Marketing

What we do

Financials

Org. Structure

Marketing

Industry

PharmUniverse spends a large proportion of its yearly budget on marketing, attempting to win the trust of customers and potential customers.

Despite being a relative newcomer in the market, these efforts have generally been successful.

Another round of well$-$publicised problems recently found in competing drugs has also given a boost to PharmUniverse's marketing efforts.

What we do

The board of directors:

Financials

Is best characterised by diversity

Has some members who have served in positions with

Org. Structure

pharmaceutical and biomedical companies, but the majority do not have this kind of background

Marketing

Industry

Is anything but risk averse, and pushes the CEO to offer

generous incentives to researchers who develop new

formulas likely to result in new and profitable pharmaceutical products

The CEO:

Is a member of the executive council, which meets bimonthly to create, evaluate and, in some cases, change corporate objectives.

$2013$ ISACA. All rights reserved.

$13$

$13$

tISACA

Background Information $-$ Org. Structure

What we do

Financials

Org. Structure

Marketing

Industry

The Research team:

Although this team does not, in a strict sense, comprise a business unit, for all practical purposes it functions like one.

It receives a yearly budget that is more than ample for a unit of fewer than $60$ employees. Most of these employees are scientists, who are led by a seasoned business professional with more than $20$ years of exper