In this paper we perform a pragmatic evaluation of the ISO
27001 metamodel [14] which was already semantically
evaluated [15]. As the figure shows, we use two additional
elements to do so: the Bugtraq vulnerability archive, a publicly
accessible database of software vulnerabilities, and an
information security process model to capture the activities of
information security managers and reflect on the applicability
of our metamodel.