Title: Chapter 11 Overview
Course: IN 2001 Principle of Information Assurance > Section: Module 11: Chapter 11

Security and Personnel
Introduction
1. When implementing information security, there are human resource issues that must be addressed.
  - First, the entire organization must decide how to position and name the security function
  - Second, the information security community of interest must plan for the proper staffing for the information security function
  - Third, the IT community of interest must understand the impact of information security across every role in the IT function and adjust job descriptions and documented practices accordingly
  - Finally, the general management community of interest must work with the information security professionals to integrate solid information security concepts into the personnel management practices of the organization
2. Understanding the impact of change on the personnel management practices of the organization is an important step in achieving success in the implementation phase.
3. Experience has shown that employees often feel threatened when an organization is creating or enhancing an information security program.
4. Resolving these doubts and reassuring the employees is a fundamental part of the implementation process.  It is important to gather employee feedback early and respond to it quickly.

Positioning and Staffing The Security Function

Credentials of Information Security Professionals

Employment Policies and Practices

Security Considerations for Nonemployees

Internal Control Strategies

Privacy and The Security of Personnel Data