Title: Class Outline 18
Course: KVCC BUS118 > Section: Class Outlines

i.           Privacy Protection in Information Systems

a.           Data life cycle

i.           Data Collection

ii.           Data Use

iii.           Data Storage

iv.           Data Retention

v.           Data Destruction

b.           Privacy Policy

ii.           International Privacy

a.           Safe harbor

Chapter 13

iii.           Information Security Governance

iv.           CIA Triad

v.           Business Planning

a.           Strategic – long term

i.           New approaches and planning and establishes the groundwork

b.           Tactical – short to medium term

i.           Market conditions and unexpected opportunities

ii.           Usually six months or less

c.           Operational – day to day planning

i.           Normal operations

vi.           ISG Planning

a.           Information Needs

i.           What data is used to meet business goals?

ii.           How can information security support this?

b.           Regulatory Requirements

i.           What laws are applicable?

c.           Risk Management

i.           What Risks are faced?

d.           Security Failures

i.           What is the impact of a security failure?

vii.           Governance Roles

a.           Board of Directors

b.           Chief Information Officer

c.           Chief Technology Officer

d.           Chief Information Security Officer

viii.           Information Security Management – PG 395

ix.           Governance Program Standards

x.           FISMA – Federal Information Security Management Act

xi.           Information Security Governance Documents

a.           What documents address

i.           Organizations information security goals

ii.           How the organization protects its own data

iii.           How the organization protects the data of others

iv.           Compliance with legal and regulatory requirements

v.           Employee information security responsibilities

vi.           Consequences for failing to meet responsibilities

b.           Policies – top level of documents and layout the information security strategy

i.           Consists of:

1.           Policy statement

2.           Policy exclusions

3.           Policy rationale

4.           Policy definitions

5.           Who is affected

6.           Who must follow

7.           Compliance language

8.           Related Documents

9.           Policy Contact

10.           Policy History

c.           Standards – support policies by stating the activities and actions to meet policy goals

i.           Baseline – the minimum level to comply with standard

d.           Procedures – lowest level and consist of step by step checklists and explain the how.

e.           Guidelines – more advice than policy

xii.           Creating Policies

a.     Must be easy to understand – example pg 402

b.     Must have a well-defined scope

c.     Must be regularly reviewed

d.     Must be communicated to all

xiii.           Policy Development Process

a.           Development

b.           Stakeholder Review

c.           Management Approval

d.           Communication to employees

e.           Documentation of compliance or exceptions

f.           Continued awareness activities

g.           Maintenance and review

Attached Files: | - KVCC BUS118_LegalAspectsBusInfoSys_Class Outlline 18(1).pdf