ipl-logo

Chief Information Security Policy Paper

1350 Words6 Pages

The Chief Information Officer (CIO) and the Chief Information Security Officer (CISO) both have significant roles in translating the organization’s overall strategic plans into information security strategic objectives (Whitman & Mattord, 2013). Additionally, they may work together in the development of the tactical and operational information security plans. However, in most circumstances, the CISO would report directly to the CIO, and as a result, their position objectives may be different.
Generally speaking, the CIO is responsible for the strategic efforts of the organization, as well as the development and integration of the IT and Information Security departmental strategic objectives, which is based on the organizational strategies (Whitman …show more content…

One way to accomplish this task is through the application of information security policy. Furthermore, organizational leadership must define three types of security policies to include general or enterprise information security policies that sets the strategic direction and scope for all security efforts within the organization, issue-specific policy which includes certain guidelines needed to instruct employees on the appropriate use of their technologies, as well as systems-specific security policy that establishes the standards to be used when configuring systems. The fundamental purpose of a security policy is to protect people and information, set the rules for expected behavior by all users, administrators, management, and security personnel, authorize security personnel to monitor, probe, and investigate, define and authorize the consequences of policy violation, help to minimize risk, and help to track compliance with security regulations and legislation (SANS Institute, 2007). Some examples of the security policies an organization would consider developing would be information classification policy, password policy, authentication policy, access control policy, incident response policy, Web security policy, e-mail security policy, and …show more content…

Additionally, information security policies will help to minimize risk and ensure that security incidents are responded to adequately. Moreover, Information security policy will help an organization to define the firm’s attitude towards information, declare that the company’s information is considered to be an asset and property of the organization, and that the organization’s assets should be protected from unauthorized access, modification, disclosure, dissemination, and destruction. However, it is important to understand that information security policies are not guidelines or standards, nor are they to be considered procedure and controls (Bragg, 2002). More accurately, information security policy should serve as the blueprints for an overall security program and define what is being protected in order to ensure the implementation of proper controls. Moreover, steps should be taken to ensure that information security policy never conflicts with state or federal laws, can stand up in court if ever challenged, and be properly administered through dissemination and documented acceptance. Furthermore, an information security policy is most effective when it is properly disseminated, understood, and agreed upon by all members of the

Show More
Related
131 Words | 1 Pages

1. Policies governing the network insecurities which include Email and communications policy, Remote Access Policy, BYOD Policy and Encryption policy 2. User accounts management through training and assigning of user roles depending on their access levels to information in the organization. 3. Setting up workstations and assigning every user a workstation.

Read More
500 Words | 2 Pages

Assignment-7 Group Policies Group Policies: Group policies specifies settings for users and computers which includes security settings, software installation, computer startup and shut down, registry based policy settings and folder redirection. Group policies are responsible for controlling the working environment of users and computers accounts. It provides the configuration and management of the user’s settings, operating system and applications in a working environment. It is responsible for the user’s actions in a computer like what a user can and cannot do on the computer for example enforce users to have a complex password to prevent the network from being accessed by unidentified users. Group policies when properly planned and implemented

Read More
223 Words | 1 Pages

The Information Security Manager reports in their capacity to the CEO. Company officers, executives, directors, employees, contractors and third party service providers cooperate and work with the Information Security Manager to ensure the protection of customer’s non-public information and Licensee’s Information Assets. Policies, such as Enterprise Antivirus Program, Network Access, Software Development Security Standards, Physical Security, Vendor Manangmenet Ativirus, Mobile Computing/Remote Access, Inromation Security Risk Assessment, Social Media, Data Loss Prevention, and Secuiryt Incident Response Policies have been implemented to protect customer’s non-public personal information and company Information

Read More
684 Words | 3 Pages

I expect everyone in the staff to respect people’s personal information and to treat the data as if it was their own. The outline of an internet usage policy, it’s a role for the human resources and IT departments, an undertaking to protect employee as well as IT network. Hence, a partnership between these two parties is vital to guarantee that a comprehensive internet usage policy is created matching the needs of the company and

Read More
490 Words | 2 Pages

There are several differences between a policy, a standard, and a guideline. Policies are typically a statement produced by senior management relating to the protection of information. It outlines security roles and responsibilities. It also describes the controls that are set in place to protect pertinent information. Each policy should make some form of reference to the standards and guidelines that support it.

Read More
578 Words | 3 Pages

In the changing and fast growing pace of technology, my position as a CIO has had to adapt to better align with our company’s business objectives. With the IT seemingly becoming more influential in the business world, it makes sense that the CIO will have more responsibilities in the company (Taewon Hwang, Discussion 1, 9:19 PM). Having a CIO as a business-strategy partner is key to alignment. Not only does he have to manage IT resources, he also must deploy and communicate IT capabilities in the way they align with the business strategic vision (Yves Laison, Discussion 1, 10:22 AM). The CIO certainly plays a crucial role in that competitive analysis, but so does every c-suite executive.

Read More
213 Words | 1 Pages

After that, section 4 mainly concerns on the status of research with current IS strategy practice. In this section, the understandings are gathered from interviews with CIO’s, and discoveries gathered from researches that were published. There were two case studies the author has conducted with his colleagues

Read More
1008 Words | 5 Pages

• Accreditation, certification, and security assessment-The security controls of the firm should be developed, assessed, and plan of actions implemented periodically. The program of activities collects deficiencies and eliminates vulnerabilities. • Risk assessment- the risk of individuals, assets and operations resulting from system operation and the associated storage processing or transmission of information, is periodically assessed. Areas of

Read More
1390 Words | 6 Pages

Information owners are responsible for classifying, maintaining controls, authorizing access, monitoring compliance with WigIT security policies and standards, managing risk, and protection of the information at WigIT. Security Program WigITs and its employees are responsible for complying with the provisions of security policies, standards, and security initiatives that will be enforced with the same standards. WigIT’s incident response team will handle all information security incidents. The security program is responsible for information classification, control approvals and access privileges, periodic reclassification, and risk reviews. Information security is vital to business continuity and the objective avoiding or mitigating risk.

Read More
1272 Words | 6 Pages

Using the framework presented in the course textbook, draft a sample issue-specific security policy for an organization. An issue-specific security policy instructs an organization to securely use a technology system. It provides detailed and targeted guidance to employees. The ISSP instructs the fundamental technological philosophy of the organization.

Read More
702 Words | 3 Pages

The introduction of ISO27001, in response to a publicly know security breach, has further provided a framework of controls that safeguard the integrity, confidentiality and availability of the information. It has additionally re-established the confidence in the organisation to safe guard its information assets and those that it is entrusted to host against unauthorised intrusion. As part of the process of implementing the ISO standards we have established 89 policies and 90 procedures in total and although not all may relate directly to ISO 9001 and ISO 27001 they are a sign of the established maturity of the organisation and the effort made towards establishing governance within.

Read More
792 Words | 4 Pages

The meaning can change, however, depending on the type of company that is using it. The textbook gives the example of the government's security policy tht refers to the country's national security and dealings with other countries. In contrast, a security policy could also refer to a bank policy that protects their customer's financial information. Regardless of where, the security policy spells out the rules for information protection whether the information is being moved, stored or processed.

Read More
1190 Words | 5 Pages

Network Security Policies A network security policy is a set of administrative rules aimed to create order and control the access and utilization of system resources in an organization. The strategy aims to ensure that the system is secure within the organization as well as securing any information destined to other systems outside. This entails protection of the organizational framework, its assets, identification of risks, risk management and damage control in case of a security breach. All these guidelines and rules should be outlined together with well-defined roles each user of the system according to their user level privileges.

Read More
1726 Words | 7 Pages

Regardless of recent efforts to apply the DOD cyber strategy, due to the decentralized approach, the incapability to meet current threats and the means to keep pace with future threats creates the gap between the theoretical strategy and the actual practicality. This paper examines the potential gaps within The DOD Cyber Strategy 2015 with the goals to recognize the weaknesses and improve The DOD Cyber Strategy 2015 to determine the lack of compliance in order to correct the weakness and maintain decent cyber

Read More
871 Words | 4 Pages

2.2: Describe practices that ensure security when storing and accessing information. • Keeping passwords on computer: this secures important information from getting accessed without authorisation. • Keeping files locked away: this only allows the people holding the key to access important files. • Coded doors: access is only permitted to the room if the person knows the code. • Putting information away: once the information is no longer being used, it is important to make sure that it’s locked away

Read More

More about Chief Information Security Policy Paper

Related Topics

Open Document