This Handbook provides an insight into how some of Australia's leading organisations have implemented information security management systems. Organisations are cautious about sharing such information because it is a source of competitive advantage. However they agreed to provide these case studies with the objective of assisting organisations and individuals to develop their own approaches to, and capabilities for, managing the implementation of information security management systems. The Handbook draws on the underlying principles in AS/NZS 4444.1:1999, Code of practice for information security management, (current edition is AS/NZS ISO/IEC 17799:2001), the risk management standard, AS/NZS 4360:1999, Risk management, and the Handbook HB 231:2000, Information security risk management guidelines.