The paramount complexity of enterprise information leads to hard-to-deal security management issues and system configurations. We present a security management framework of an arbitrary information system (IS) which builds upon knowledge-based resources, such as security ontology (SO) providing reusable security knowledge interoperability, aggregation and reasoning exploiting security knowledge from diverse sources; in addition, the separation of security requirements from their technical implementations facilitates the security management. We provide a feasible framework, which links the high-level policy statements and deployable security controls and facilitates the security expert?s work.