Title: Class Outline 19
Course: KVCC BUS118 > Section: Class Outlines

i.           ISG Planning

a.           Information Needs

i.           What data is used to meet business goals?

ii.           How can information security support this?

b.           Regulatory Requirements

i.           What laws are applicable?

c.           Risk Management

i.           What Risks are faced?

d.           Security Failures

i.           What is the impact of a security failure?

ii.           Governance Roles

a.           Board of Directors

b.           Chief Information Officer

c.           Chief Technology Officer

d.           Chief Information Security Officer

iii.           Information Security Management – PG 395

iv.           Governance Program Standards

v.           FISMA – Federal Information Security Management Act

vi.           Information Security Governance Documents

a.           What documents address

i.           Organizations information security goals

ii.           How the organization protects its own data

iii.           How the organization protects the data of others

iv.           Compliance with legal and regulatory requirements

v.           Employee information security responsibilities

vi.           Consequences for failing to meet responsibilities

b.           Policies – top level of documents and layout the information security strategy

i.           Consists of:

1.           Policy statement

2.           Policy exclusions

3.           Policy rationale

4.           Policy definitions

5.           Who is affected

6.           Who must follow

7.           Compliance language

8.           Related Documents

9.           Policy Contact

10.           Policy History

c.           Standards – support policies by stating the activities and actions to meet policy goals

i.           Baseline – the minimum level to comply with standard

d.           Procedures – lowest level and consist of step by step checklists and explain the how.

e.           Guidelines – more advice than policy

vii.           Creating Policies

a.     Must be easy to understand – example pg 402

b.     Must have a well-defined scope

c.     Must be regularly reviewed

d.     Must be communicated to all

viii.           Policy Development Process

a.           Development

b.           Stakeholder Review

c.           Management Approval

d.           Communication to employees

e.           Documentation of compliance or exceptions

f.           Continued awareness activities

g.           Maintenance and review

ix.           Recommended IS Policies

a.           Acceptable Use Policies

i.           Enforcement

b.           Anti-Harassment Policies

i.           Definition

ii.           Reporting

iii.           Investigation

iv.           No Retaliation

v.           Sanctions

c.           Workplace privacy and Monitoring

d.           Data Retention and Destruction Policies

e.           Intellectual Property Policies

f.           Authentication and Password Policies

i.           Something a user knows

ii.           Something a user has

iii.           Something a user is

g.           Security awareness and training

x.           Case studies

Attached Files: | - KVCC BUS118_LegalAspectsBusInfoSys_Class Outlline 19(1).pdf