Abstract:
A method for assessing an information security policy and practice of an organization, including determining a risk associated with the information security policy and practice, collecting information about the information security policy and practice, generating a rating using a security maturity assessment matrix, the collected information, and the risk associated with the information security policy and practice, generating a list of corrective actions using the rating, executing the list of corrective actions to create a new security information policy and practice, and monitoring the new security information policy and practice.

Description:
BACKGROUND OF INVENTION 
     Information Security encompasses the protection of information against unauthorized disclosure, transfer, modification, or destruction, whether accidental or intentional. Information security has become a prevalent concern of organizations as a result of the trends towards e-commerce, e-business, universal email and web access, and well-publicized security exploits. As a result, organizations are attempting to apply information security principles in a pragmatic framework. 
     To enable organizations to apply information security principles in a pragmatic framework, a number of information standards and tools have been developed. One widely recognized standard, BS7799/ISO17799, was developed by the British Standards Institution (BSI) and adopted by the International Organization for Standardization (ISO). The BS7799/ISO17799 standard is a comprehensive set of controls that outline best mode practices in information security. The aim of BS7799/ISO17799 is to serve as a single reference point to determine the appropriate information security policy for a variety of systems and organizations. The BS7799/ISO17799 standard includes 10 sections, each addressing a specific area of information security. See, “ISO17799 Security Standard: ISO 17799 Compliance &amp; Positioning.” 
     The process of managing compliance with the BS7799/ISO17799 is a non-trivial task. As a result, a number of risk analysis and risk management products have been developed to help organizations comply with the BS7799/ISO017799 standard. One such product is COBRA, which was developed by C &amp; A Systems, Inc. COBRA is used to semi-automate the assessment process. COBRA utilizes a series of online questionnaires to obtain information about the current security policy. Using the answers from the questionnaires, COBRA creates reports that provide information about the organization&#39;s current compliance position, on a pass/fail basis, with respect to each section of the BS7799/ISO17799 standard. 
     Another tool that has been developed to enable organizations to apply information security principles in a pragmatic framework is the Systems Security Engineering Capability Maturity Model (SSE-CMM). The SSE-CMM is derived from concepts of the Software Engineering Institute (SEI) Capability Maturity Model initially created for software development. The SSE-CMM describes the essential characteristics of an organization&#39;s security engineering process that must exist to ensure good security engineering. The SSE-CMM does not prescribe a process or standard such as BS7799/ISO17799, but rather uses a model that captures practices generally observed in the industry. Additionally, the SSE-CMM is based on a maturity model that defines specific goals and practices for the entire life cycle of an organization. Further, the SSE-CMM defines an overall assessment process and roles for security engineering within an organization. See, “System Security Engineering Capability Maturity Model-Model &amp; Appraisal Method Summary April 1999.” The resulting assessment obtained from applying the SSE-CCM is typically not associated with a reporting tool to report the maturity level. 
     SUMMARY OF INVENTION 
     In general, in one aspect, the invention relates to a method for assessing an information security policy and practice of an organization, comprising determining a risk associated with the information security policy and practice, collecting information about the information security policy and practice, generating a rating using a security maturity assessment matrix, the collected information, and the risk associated with the information security policy and practice, generating a list of corrective actions using the rating, executing the list of corrective actions to create a new security information policy and practice, and monitoring the new security information policy and practice. 
     In general, in one aspect, the invention relates to an apparatus for assessing an information security policy and practice of an organization, comprising means for determining a risk associated with the information security policy and practice, means for collecting information about the information security policy and practice, means for generating a rating using a security maturity assessment matrix, the collected information, and the risk associated with the information security policy and practice, means for generating a list of corrective actions using the rating, means for executing the list of corrective actions to create a new security information policy, and means for monitoring the new security information policy. 
     In general, in one aspect, the invention relates to a computer system for assessing an information security policy and practice of an organization, comprising a processor, a memory, an input means, and software instructions stored in the memory for enabling the computer system under control of the processor, to perform determining a risk associated with the information security policy and practice, collecting information about the information security policy and practice using the input means, generating a rating using a security maturity assessment matrix, the collected information, and the risk associated with the information security policy and practice, generating a list of corrective actions using the rating, executing the list of corrective actions to create a new security information policy and practice, and monitoring the new security information policy and practice. 
     Other aspects and advantages of the invention will be apparent from the following description and the appended claims. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  illustrates a typical computer system. 
         FIG. 2  illustrates a flowchart detailing the Security Maturity Assessment method in accordance with one embodiment of the invention. 
         FIG. 3  illustrates a portion of a Security Maturity Assessment Reporting Tool report in accordance with one or more embodiments of the invention. 
         FIG. 4  illustrates a flowchart detailing the Security Maturity Assessment method in accordance with another embodiment of the invention. 
     
    
    
     DETAILED DESCRIPTION 
     Exemplary embodiments of the invention will be described with reference to the accompanying drawings. Like items are denoted by like reference numerals throughout the drawings for consistency. 
     In the following detailed description of the invention, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to one of ordinary skill in the art that the invention may be practiced without these specific details. In other instances, well-known features have not been described in detail to avoid obscuring the invention. 
     The invention relates to a method for assessing a security maturity of an organization. Further, the invention relates to assessing the security maturity of an organization using a security assessment matrix. Further, the invention relates to basing the security assessment matrix on the BS7799/ISO17799 standard and the Capability Maturity Model (CMM). Further, the invention relates to a method for providing quantitative, action-oriented results using the security assessment matrix. Further, the invention relates to a method to compare the security maturity of an organization to a pre-determined goal, or to the security maturity of the same organization at another point in time, or to the security maturity level mandated by another organization or authority. 
     The invention may be implemented on virtually any type computer regardless of the platform being used. For example, as shown in  FIG. 1 , a typical computer ( 28 ) includes a processor ( 30 ), associated memory ( 32 ), a storage device ( 34 ), and numerous other elements and functionalities typical of today&#39;s computers (not shown). The computer ( 28 ) may also include input means, such as a keyboard ( 36 ) and a mouse ( 38 ), and output means, such as a monitor ( 40 ). Those skilled in the art will appreciate that these input and output means may take other forms in an accessible environment. 
     The Security Maturity Assessment (SMA) method involves five distinct stages: (1) management awareness and commitment, (2) security maturity assessment, (3) corrective action plan (CAP), (4) corrective action plan execution (CAPE), and (5) ongoing monitoring. Each of the aforementioned stages is explained below in greater detail. Those skilled in the art will appreciate that the names used to denote the stages may vary without detracting from the invention. 
       FIG. 2  illustrates a flowchart detailing the SMA method in accordance with one embodiment of the invention. The SMA method is initiated by ensuring that an organization&#39;s management is aware and committed to improving the organization&#39;s information security practices and policies (Step  100 ). An assessment entity (e.g., individual/company conducting assessment) then assesses the organization&#39;s information security practices and policies (Step  102 ). Using the information gained in Step  102 , the assessment entity develops a corrective action plan (Step  104 ). The corrective action plan is subsequently executed (Step  106 ). If the organization desires continuous monitoring after the execution of the corrective action plan (Step  108 ), then the assessment entity may continuously monitor revised information security policies and practices of the organization (Step  110 ). Following the continuous monitoring, the method may return to Step  100  to ensure that the organization&#39;s management is still aware and committed, or potentially proceed directly to Step  102  if the organization&#39;s management continues to be aware and committed. If the organization desires not to have continuous monitoring after the execution of the corrective action plan (Step  108 ), then the method ends. 
     The management awareness and commitment stage is the first stage of the SMA method and is used to raise awareness within the management of the organization being assessed and to initiate gathering of information. Specifically, in the management awareness and commitment stage, an assessment entity gathers information to understand the organization&#39;s business goals. Further, the assessment entity gathers information to understand the associated risks in terms of information security. For example, if the organization is using a wireless Local Area Network (LAN), there are different information security risks to consider than if the organization is using a conventional LAN where all computers are connected via Ethernet cable. Additionally, the assessment entity creates awareness in the organization by presenting the security maturity assessment methodology and method. In one or more embodiments of the invention, the assessment entity may also provide additional information about the underlying standards, e.g., the ISO standard. In one or more embodiments of the invention, the assessment entity may also provide an explanation of the concept of a maturity model as it applies to the security assessment. 
     The security maturity assessment stage is initiated by the assessment entity identifying participants required to perform the SMA. Additionally, the assessment entity, in conjunction with the organization, determines the effect and cost to be used to perform the SMA. A time line is also set to allow the assessment entity and the organization to have a means to track the progress of the SMA. At this point, in one or more embodiments of the invention, the assessment entity may request that the organization sign an assessment contract to ensure commitment by the organization to follow through with the SMA. Once the aforementioned steps have been completed, the assessment entity proceeds to perform the SMA. 
     The assessment entity initiates the SMA by collecting documents detailing the organization&#39;s existing information security policies and practices. After review of the collected documents, additional information is typically obtained via interviews with participants identified at the beginning of this stage. Using the information obtained from the collected documents and the interviews, a preliminary rating is generated. The preliminary rating details the maturity of individual sections and the overall maturity level of the organization&#39;s information security practices and policies. 
     In one or more embodiments of the invention, the preliminary rating is generated using a security assessment matrix (SAM). The SAM defines each level of maturity for each information security item. The SAM includes 61 rows corresponding to the groups of the BS7799/ISO17799 standard information security items, and 5 columns defining the maturity level. The five maturity levels, arranged from least mature to most mature, are Initial (Level 1), Repeatable (Level 2), Defined (Level 3), Managed (Level 4), and Optimizing (Level 5). For each intersection of row and column, there is a paragraph that defines a specific “capability maturity” level. The paragraphs contained in a given row of the SAM represent successive capability maturity levels for the same information security item. Further, some rows of the SAM represent successive capability maturity levels associated with a single information security item, as described in one paragraph of the BS7799/ISO17799 standard. Other rows of the SAM may represent successive capability maturity levels of information security items that the BS7799/ISO17799 standard describes in separate paragraphs or sections. 
     In one or more embodiments of the invention, an item definition for each information security item is included in the SAM. The item definition acts as a legend for the level definitions for a particular information security item. Further, in one or more embodiments of the invention, the SAM includes level definitions as follows: Level 1—Initial; Level 2—Not written down, but communicated via coaching; Level 3—Written down; Level 4—Responsibility is defined; Level 5—Process exists for catching deviations and improving the information security to prevent them. Further, in one or more embodiments of the invention, the SAM includes scope requirements. The scope requirements indicate to which various aspect of an organization&#39;s operations the criteria set forth in a particular row of the SAM must be applied. 
     The combination of a certain level definition (e.g., Level 1) with one information security item (i.e., a specific row of the SAM) yields a specific criterion that one skilled in the art can apply to establish if the organization being assessed meets, fails or exceeds this level of maturity for this information security item. Furthermore, those skilled in the art can apply the general definition of the maturity level (Level 1 through 5) to a specific information security item in such a way that they can readily determine whether the organization being assessed meets, fails or exceeds this level of maturity for this security item, even if the specific criterion set forth at the intersection of this row and column of the SAM is, for any reason, not directly applicable in the case of this organization. 
     Table 1 illustrates the SAM in accordance with one or more embodiments of the invention: 
     
       
         
               
             
               
               
             
               
               
               
               
               
               
               
               
             
               
               
               
               
               
               
               
               
               
             
               
               
               
             
               
               
               
               
               
               
               
               
               
             
               
               
               
             
               
               
               
               
               
               
               
               
               
             
           
               
                 TABLE 1 
               
             
             
               
                   
               
               
                 Security Assessment Matrix 
               
             
          
           
               
                   
                 Level Definitions 
               
             
          
           
               
                   
                   
                   
                 Level 2 
                   
                   
                   
                   
               
               
                   
                   
                   
                 (Repeatable) 
                   
                   
                 Level 5 
               
               
                   
                   
                   
                 Not written 
                   
                 Level 4 
                 (Optimizing) 
               
               
                   
                   
                   
                 down, but 
                 Level 3 
                 (Managed) 
                 Process exists for catching 
               
               
                 ISO 17799 
                 Item 
                 Level 1 
                 communicated 
                 (Defined) 
                 Responsibility is 
                 deviations and making 
                 Scope 
               
               
                 Categories 
                 Definitions 
                 (Initial) 
                 via coaching 
                 Written down 
                 defined 
                 constant improvements 
                 Requirements 
               
               
                   
               
             
          
           
               
                 III.1 
                 Information 
                 Coverage of 
                 No security 
                 Security policy 
                 Specific 
                 Security policy 
                 Clear responsibilities and 
                 Goal and principle of 
               
               
                   
                 Security Policy 
                 Security Policy 
                 policy in 
                 exists, but as a 
                 policy exists, 
                 covers all areas of 
                 mechanisms in place to 
                 every information security 
               
               
                   
                   
                 Review of effective 
                 place 
                 general 
                 clearly stating 
                 business. Security 
                 upgrade policy if required 
                 Information sharing 
               
               
                   
                   
                 implementation of 
                   
                 statement. 
                 in detail what 
                 policy is owned by 
                 after every breach of 
                 management and 
               
               
                   
                   
                 information security 
                   
                 Inferring what 
                 is mandated 
                 appropriate functions 
                 policy, also if business 
                 responsibilities 
               
               
                   
                   
                 policy 
                   
                 is specifically 
                 or prohibited. 
                 including IT but also 
                 changes (acquisition, 
               
               
                   
                   
                 Review of 
                   
                 mandated or 
                 A “normal” 
                 Finance, HR, Legal, 
                 divestiture, or major changes 
               
               
                   
                   
                 Information 
                   
                 prohibited 
                 person can 
                 etc. Organization 
                 in process such as 
               
               
                   
                   
                 Security Policy 
                   
                 requires 
                 easily 
                 policies define the 
                 outsourcing) occur. 
               
               
                   
                   
                   
                   
                 consulting 
                 understand it. 
                 roles and responsibilities in 
               
               
                   
                   
                   
                   
                 specialized 
                 Reviews 
                 following procedures. 
               
               
                   
                   
                   
                   
                 personnel. No 
                 carried out at 
                 Reviews 
               
               
                   
                   
                   
                   
                 regular reviews. 
                 intervals, but 
                 carried out - intervals 
               
               
                   
                   
                   
                   
                   
                 no clear 
                 and responsibility for 
               
               
                   
                   
                   
                   
                   
                 management 
                 the reviews are 
               
               
                   
                   
                   
                   
                   
                 responsibility 
                 defined explicitly in the 
               
               
                   
                   
                   
                   
                   
                 to trigger 
                 policy. 
               
               
                   
                   
                   
                   
                   
                 reviews or 
               
               
                   
                   
                   
                   
                   
                 exploit results 
               
               
                   
                   
                 Availability of 
                 No security 
                 Security policy 
                 There is a 
                 Security policy 
                 Each security incident is 
                 Staff awareness and 
               
               
                   
                   
                 Security Policy to 
                 policy 
                 is discussed 
                 Security 
                 communication is 
                 subject to a post mortem 
                 education 
               
               
                   
                   
                 Employees 
                 communication 
                 with employees 
                 Policy 
                 part of written IT and 
                 procedure that includes a 
                 Responsibilities and emergency 
               
               
                   
                   
                 Security Education 
                 to 
                 and contract or 
                 manual, 
                 Personnel procedures. 
                 review of whether applicable 
                 arrangements 
               
               
                   
                   
                 and Technical 
                 employees 
                 temporary 
                 mentioned on 
                 Training and/or 
                 policies were 
                 Well defined policy 
               
               
                   
                   
                 Training 
                 (non- 
                 personnel upon 
                 public notice 
                 communication on 
                 correctly communicated. 
                 Security training integrated into 
               
               
                   
                   
                   
                 existent, or 
                 hiring. 
                 board and/or 
                 security policy occur at least 
                 Users are taught the 
                 personnel development program 
               
               
                   
                   
                   
                 limited to 
                   
                 on web page. 
                 once a year. 
                 incident reporting procedures. 
                 Management 
               
               
                   
                   
                   
                 IT 
                   
                   
                   
                   
                 responsibility to provide security 
               
               
                   
                   
                   
                 personnel). 
                   
                   
                   
                   
                 training, including the 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 specification of a clear desk and 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 clear screen policy for 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 all employees. 
               
               
                   
                   
                 Review of Security 
                 Issued once, 
                 Occasionally 
                 Reviewed at 
                 A clearly 
                 There is a defined 
                 General management 
               
               
                   
                   
                 Process 
                 never 
                 reviewed if 
                 intervals, but 
                 designated person 
                 mechanism to 
                 responsibility 
               
               
                   
                   
                   
                 reviewed 
                 senior 
                 no clear 
                 or body has 
                 review and 
                   
               
               
                   
                   
                   
                   
                 management, 
                 management 
                 responsibility for 
                 upgrade the 
               
               
                   
                   
                   
                   
                 auditors, etc., 
                 responsibility 
                 the process, and 
                 policy after every 
               
               
                   
                   
                   
                   
                 ask 
                 to trigger 
                 reviews it regularly. 
                 security incident 
               
               
                   
                   
                   
                   
                   
                 reviews of 
                   
                 (is anything missing 
               
               
                   
                   
                   
                   
                   
                 exploit results 
                   
                 from the policy that could 
               
               
                   
                   
                   
                   
                   
                   
                   
                 have prevented the problem?) 
               
               
                 IV.1 
                 Information 
                 Responsibility for 
                 No 
                 Specific 
                 A matrix for 
                 A specific party is 
                 Security 
                 Individual 
               
               
                   
                 Security 
                 the protection of 
                 responsibility 
                 individuals are 
                 the 
                 responsible for 
                 responsibility is a 
                 assets refer to 
               
               
                   
                 Infrastructure 
                 individual assets 
                 is assigned. 
                 aware of their 
                 responsibility 
                 defining and 
                 required field in 
                 the 
               
               
                   
                   
                   
                   
                 responsibility 
                 of protection 
                 maintaining the 
                 the asset 
                 organization&#39;s 
               
               
                   
                   
                   
                   
                 to protect some 
                 of assets 
                 responsibility 
                 management process, so rows 
                 physical 
               
               
                   
                   
                   
                   
                 assets. The list 
                 exists and is 
                 matrix for the 
                 in the matrix are created when 
                 assets (e.g., 
               
               
                   
                   
                   
                   
                 of assigned 
                 published. 
                 protection of 
                 new assets are acquired. Assets 
                 computers, 
               
               
                   
                   
                   
                   
                 responsibilities 
                   
                 individual assets. 
                 without a responsible party is 
                 printers, 
               
               
                   
                   
                   
                   
                 is not 
                   
                 Successive 
                 immediately flagged for 
                 media, etc.) 
               
               
                   
                   
                   
                   
                 documented. 
                   
                 versions of the matrix are 
                 corrective action. 
               
               
                   
                   
                   
                   
                   
                   
                 archived to help in 
               
               
                   
                   
                   
                   
                   
                   
                 future investigations. 
               
               
                   
                   
                 Security in job 
                 No formally 
                 Specific 
                 Responsibility 
                 A specific party is 
                 Job descriptions 
                 Interpretation 
               
               
                   
                   
                 definition and 
                 defined 
                 individuals are 
                 for security 
                 responsible for 
                 and personnel 
                 is based on 
               
               
                   
                   
                 resourcing 
                 process. 
                 aware of their 
                 decision 
                 developing job 
                 screening 
                 SSO/IRT 
               
               
                   
                   
                   
                   
                 responsibility. 
                 making has 
                 responsibilities, 
                 arrangements are 
                 type position. 
               
               
                   
                   
                   
                   
                   
                 been assigned 
                 personnel 
                 periodically 
               
               
                   
                   
                   
                   
                   
                 and 
                 screening and 
                 reviewed to 
               
               
                   
                   
                   
                   
                   
                 documented. 
                 confidentiality 
                 conform to the 
               
               
                   
                   
                   
                   
                   
                   
                 agreements. 
                 changing security 
               
               
                   
                   
                   
                   
                   
                   
                   
                 needs of the 
               
               
                   
                   
                   
                   
                   
                   
                   
                 business. Also 
               
               
                   
                   
                   
                   
                   
                   
                   
                 personnel are 
               
               
                   
                   
                   
                   
                   
                   
                   
                 required to sign 
               
               
                   
                   
                   
                   
                   
                   
                   
                 and agree to 
               
               
                   
                   
                   
                   
                   
                   
                   
                 confidentiality 
               
               
                   
                   
                   
                   
                   
                   
                   
                 agreements. 
               
               
                   
                   
                 Information security 
                 No formally 
                 Key members 
                 Training for 
                 A specific party is 
                 Security curriculum is 
               
               
                   
                   
                 education and 
                 defined 
                 of personnel 
                 personnel is 
                 responsible for 
                 periodically reviewed to 
               
               
                   
                   
                 training 
                 training plan 
                 are trained on 
                 defined and 
                 defining the 
                 conform to the changing 
               
               
                   
                   
                   
                   
                 an ad-hoc 
                 performed 
                 training plan 
                 needs of the business. 
               
               
                   
                   
                   
                   
                 basis. 
                 periodically. 
                 developing 
                 Training records are reviewed 
               
               
                   
                   
                   
                   
                   
                   
                 training schedules 
                 against policy and exceptions 
               
               
                   
                   
                   
                   
                   
                   
                 for all personnel 
                 lead to training program updates. 
               
               
                   
                   
                 Approval process 
                 No approval 
                 Informal, 
                 A clear 
                 A specific party is 
                 The approval 
               
               
                   
                   
                 for the acquisition 
                 process 
                 undocumented 
                 approval 
                 responsible for 
                 process is 
               
               
                   
                   
                 and installation of 
                 exists. 
                 knowledge of 
                 process is 
                 defining and 
                 periodically 
               
               
                   
                   
                 IT facilities. 
                   
                 steps to be 
                 defined for 
                 maintaining the 
                 reviewed to 
               
               
                   
                   
                   
                   
                 followed when 
                 the 
                 approval process 
                 conform to the 
               
               
                   
                   
                   
                   
                 acquiring or 
                 acquisition 
                 for IT facility 
                 changing needs 
               
               
                   
                   
                   
                   
                 installing IT 
                 and 
                 acquisition and 
                 of the business. 
               
               
                   
                   
                   
                   
                 facilities exists. 
                 installation of 
                 installation. 
                 The approval 
               
               
                   
                   
                   
                   
                   
                 IT facilities 
                   
                 process for each 
               
               
                   
                   
                   
                   
                   
                 and published 
                   
                 acquisition and 
               
               
                   
                   
                   
                   
                   
                 across the 
                   
                 installation of IT 
               
               
                   
                   
                   
                   
                   
                 enterprise. 
                   
                 facilities is 
               
               
                   
                   
                   
                   
                   
                   
                   
                 reviewed for 
               
               
                   
                   
                   
                   
                   
                   
                   
                 accuracy and 
               
               
                   
                   
                   
                   
                   
                   
                   
                 corrective action 
               
               
                   
                   
                   
                   
                   
                   
                   
                 is taken where 
               
               
                   
                   
                   
                   
                   
                   
                   
                 appropriate. 
               
               
                 IV.2 
                 Security of 
                 Security Control of 
                 No control 
                 Physical access 
                 The access 
                 Third-party access 
                 The access logs 
               
               
                   
                 Third Party 
                 Third Party Access 
                 mechanism 
                 control allows 
                 control rules 
                 is linked to the rest 
                 and the list of 
               
               
                   
                 Access 
                 to Information 
                   
                 ad hoc 
                 are 
                 of the 
                 authorized third 
               
               
                   
                   
                 Processing Facilities 
                   
                 decisions by IT 
                 documented. 
                 organization&#39;s 
                 parties is 
               
               
                   
                   
                   
                   
                 staff, who have 
                 There is a 
                 security system 
                 regularly audited 
               
               
                   
                   
                   
                   
                 been told 
                 formal 
                 through the 
                 and changes to 
               
               
                   
                   
                   
                   
                 informally 
                 contract with 
                 issuance of access 
                 procedures is 
               
               
                   
                   
                   
                   
                 what to do. 
                 each party 
                 tokens, and 
                 made when the 
               
               
                   
                   
                   
                   
                   
                 that requires 
                 accesses are 
                 need arises. 
               
               
                   
                   
                   
                   
                   
                 access. 
                 logged. 
               
               
                 IV.3 
                 Outsourcing 
                 Security Controls 
                 None; 
                 IT, Security, 
                 The 
                 There is a registry 
                 Procedures are 
                 Critical applications 
               
               
                   
                   
                 for External 
                 contractors 
                 Legal, or 
                 procedures for 
                 of contractors. 
                 reviewed on at 
                 stay in house 
               
               
                   
                   
                 Contractors 
                 are handled 
                 Purchasing 
                 contractor 
                 They sign the 
                 least an annual 
                 Approval of business owners. 
               
               
                   
                   
                   
                 by task 
                 apply some 
                 security are 
                 security policy, 
                 basis for possible 
                 Implications for business 
               
               
                   
                   
                   
                 owner 
                 regular steps 
                 documented 
                 NODE and IP 
                 improvements. 
                 continuity plans. 
               
               
                   
                   
                   
                 without 
                 when a 
                 in writing and 
                 agreements. 
                   
                 Security standards and 
               
               
                   
                   
                   
                 specific 
                 contract is 
                 personnel and 
                 Audits are run at 
                   
                 compliance 
               
               
                   
                   
                   
                 policies or 
                 issued. These 
                 managers 
                 least quarterly to 
                   
                 Security incident procedures. 
               
               
                   
                   
                   
                 procedures. 
                 steps are not 
                 have access to 
                 make sure the list 
               
               
                   
                   
                   
                   
                 specifically 
                 them and are 
                 of contractors is 
                   
               
               
                   
                   
                   
                   
                 documented. 
                 aware of their 
                 current. The 
               
               
                   
                   
                   
                   
                   
                 contents. 
                 owner of the 
                   
               
               
                   
                   
                   
                   
                   
                   
                 process is defined. 
                   
               
               
                 V.1 
                 Accountability 
                 Coverage of Asset 
                 No inventory 
                 Manual 
                 Inventory 
                 Schedule, triggers, 
                 There is a process 
                 Information 
               
               
                   
                 for Assets 
                 Inventory 
                   
                 inventory, 
                 performed 
                 roles and 
                 to review what 
                 Asset 
               
               
                   
                   
                 Maintenance 
                   
                 occasional, on 
                 according to 
                 responsibly, are 
                 happened after 
                 Inventory 
               
               
                   
                   
                   
                   
                 demand. 
                 written 
                 defined. 
                 each inventory. 
                 Software 
               
               
                   
                   
                   
                   
                   
                 procedures, 
                 Ownership is clear 
                 Inventories are 
                 Asset 
               
               
                   
                   
                   
                   
                   
                 but schedule 
                 and known 
                 incremental, not 
                 Inventory 
               
               
                   
                   
                   
                   
                   
                 and triggering 
                 throughout the IT 
                 from scratch 
                 Physical 
               
               
                   
                   
                   
                   
                   
                 events are not 
                 organization and 
                 every time. Asset 
                 Asset 
               
               
                   
                   
                   
                   
                   
                 well defined. 
                 management. 
                 inventories are 
                 Inventory 
               
               
                   
                   
                   
                   
                   
                 Typically not 
                   
                 automated. 
                 Services 
               
               
                   
                   
                   
                   
                   
                 automated. 
                   
                   
                 Inventory 
               
               
                   
                   
                 Ease of Alteration 
                 Information 
                 There is 
                 There is a 
                 There are control 
                 There is a 
                 Printed 
               
               
                   
                   
                 of Information 
                 assets can be 
                 informal 
                 documented 
                 mechanisms (e.g., 
                 mechanism in 
                 Reports 
               
               
                   
                   
                 Assets 
                 altered 
                 knowledge that 
                 change 
                 access controls) to 
                 place to review 
                 Screen 
               
               
                   
                   
                   
                 without 
                 classified 
                 procedure that 
                 prevent alteration 
                 the effectiveness 
                 Displays 
               
               
                   
                   
                   
                 control 
                 documents 
                 applies to all 
                 without proper 
                 of the change 
                 Magnetic 
               
               
                   
                   
                   
                   
                 cannot be 
                 classified 
                 authorization. 
                 control process 
                 Media 
               
               
                   
                   
                   
                   
                 altered at will, 
                 information 
                   
                 and detect the 
                 Electronic 
               
               
                   
                   
                   
                   
                 but no 
                 assets. No 
                   
                 need for 
                 Messages 
               
               
                   
                   
                   
                   
                 systematic 
                 systematic 
                   
                 improvements. 
                 File Transfers 
               
               
                   
                   
                   
                   
                 procedures. 
                 control 
               
               
                   
                   
                   
                   
                   
                 mechanisms 
               
               
                   
                   
                   
                   
                   
                 in place. 
               
               
                   
                   
                 Coverage of 
                 No 
                 Covers some 
                 There is an 
                 Information 
                 Information 
                 Information 
               
               
                   
                   
                 Information 
                 procedures in 
                 information 
                 Information 
                 handling 
                 handling training 
                 Asset 
               
               
                   
                   
                 Handling 
                 place for 
                 assets. Little 
                 Handling 
                 procedures are 
                 is part of written 
                 Inventory 
               
               
                   
                   
                 Procedures 
                 handling 
                 formality. No 
                 manual, 
                 owned by 
                 IT and Personnel 
                 Software 
               
               
                   
                   
                   
                 information. 
                 regular 
                 mentioned on 
                 appropriate 
                 procedures. 
                 Asset 
               
               
                   
                   
                   
                   
                 reviews. 
                 the public 
                 functions including 
                 Processes in 
                 Inventory 
               
               
                   
                   
                   
                   
                 Applied by few 
                 web page, and 
                 IT but also 
                 place to report 
                 Physical 
               
               
                   
                   
                   
                   
                 business units. 
                 covering 
                 Finance, HR, 
                 and learn from 
                 Asset 
               
               
                   
                   
                   
                   
                   
                 essentially all 
                 Legal, etc. 
                 cases when 
                 Inventory 
               
               
                   
                   
                   
                   
                   
                 types of assets 
                 Organization 
                 information has 
                 Services 
               
               
                   
                   
                   
                   
                   
                 and all 
                 policies define the 
                 been handled 
                 Inventory 
               
               
                   
                   
                   
                   
                   
                 business 
                 roles and 
                 incorrectly. 
                 Printed 
               
               
                   
                   
                   
                   
                   
                 units. 
                 responsibilities in 
                   
                 Reports 
               
               
                   
                   
                   
                   
                   
                   
                 following 
                   
                 Screen 
               
               
                   
                   
                   
                   
                   
                   
                 procedures. 
                   
                 Displays 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Magnetic 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Media 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Electronic 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Messages 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 File Transfers 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 (“Handling” = 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 copying, 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 storage, 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 electronic 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 transmission, 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 spoken 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 transmission, 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 destruction) 
               
               
                 V.2 
                 Information 
                 Classification of 
                 No 
                 Ad hoc 
                 Information 
                 Ownership of the 
                 Security 
                 Printed 
               
               
                   
                 Classification 
                 Information Assets 
                 classification 
                 classification, 
                 asset 
                 classification is 
                 classification is 
                 Reports 
               
               
                   
                   
                 Labeling of 
                   
                 at document 
                 classification 
                 clearly defined as 
                 reviewed 
                 Engineering 
               
               
                   
                   
                 Information Assets 
                   
                 owner&#39;s 
                 is published 
                 part of company 
                 periodically. List 
                 files (photos, 
               
               
                   
                   
                   
                   
                 initiative. 
                 and “pushed” 
                 procedures and is 
                 of documents 
                 microfiche, 
               
               
                   
                   
                   
                   
                 Most 
                 to all potential 
                 known of 
                 with highest 
                 etc.) 
               
               
                   
                   
                   
                   
                 documents not 
                 document 
                 management. 
                 classification is 
                 Screen 
               
               
                   
                   
                   
                   
                 marked. If 
                 owners. It 
                   
                 reviewed 
                 Displays 
               
               
                   
                   
                   
                   
                 marked, labels 
                 covers 
                   
                 periodically. 
                 Magnetic 
               
               
                   
                   
                   
                   
                 are 
                 security. 
                   
                 Declassification 
                 Media 
               
               
                   
                   
                   
                   
                 inconsistent. 
                 Classified 
                   
                 procedures exist. 
                 Electronic 
               
               
                   
                   
                   
                   
                 No systematic 
                 information is 
                   
                   
                 Messages File Transfers 
               
               
                   
                   
                   
                   
                 awareness 
                 labeled, 
               
               
                   
                   
                   
                   
                 campaign. 
                 consistently. 
               
               
                 VI.1 
                 Security in Job 
                 Screening of 
                 Incomplete 
                 Screening of 
                 Documented and 
                 A specific party is 
                 Procedures are 
                 Applicant 
               
               
                   
                 Definition and 
                 new 
                 or a lack of 
                 applicants is 
                 published 
                 responsible for 
                 reviewed regularly 
                 refers to all 
               
               
                   
                 Resourcing 
                 applicants. 
                 screening of 
                 performed 
                 procedures for 
                 defining and 
                 for improvements 
                 employees 
               
               
                   
                   
                 Complete 
                 applicants. 
                 informally, is 
                 applicant 
                 maintaining the 
                 and compliance. 
                 (contractor, 
               
               
                   
                   
                 checking of 
                 Contractor 
                 not documented, 
                 screening exist 
                 screening procedure. 
                 Security issues found 
                 permanent, 
               
               
                   
                   
                 the new 
                 hiring are 
                 and is not 
                 and are used by 
                 Results of the 
                 to be related to 
                 or part time) 
               
               
                   
                   
                 applicant&#39;s 
                 not vetted 
                 performed 
                 the organization. 
                 screening are 
                 failings in the 
               
               
                   
                   
                 CV. 
                 through HR. 
                 consistently. 
                   
                 captured in the 
                 screening procedure 
               
               
                   
                   
                 Screening of 
                   
                   
                   
                 applicant&#39;s HR file. 
                 mandate immediate 
               
               
                   
                   
                 contractor 
                   
                   
                   
                   
                 review and update of 
               
               
                   
                   
                 and 
                   
                   
                   
                   
                 the procedure. 
               
               
                   
                   
                 temporary 
               
               
                   
                   
                 staff 
               
               
                 VI.2 
                 User Training 
                 Security 
                 Little 
                 Discussed with 
                 Documented in 
                 Roles and 
                 Audits of the security 
               
               
                   
                   
                 awareness of 
                 awareness of 
                 employees and 
                 writing and made 
                 responsibilities to 
                 acknowledgments are 
               
               
                   
                   
                 personnel 
                 corporate 
                 contract or 
                 available to all 
                 maintain and 
                 performed. A system 
               
               
                   
                   
                   
                 security. 
                 temporary 
                 staff. Employees 
                 communicate the 
                 of re- 
               
               
                   
                   
                   
                   
                 personnel upon 
                 receive a copy of 
                 security policy are 
                 acknowledgment 
               
               
                   
                   
                   
                   
                 hiring. 
                 security policy on 
                 defined. 
                 occurs periodically 
               
               
                   
                   
                   
                   
                   
                 hiring and are 
                 Acknowledgement 
                 and upon changes to 
               
               
                   
                   
                   
                   
                   
                 required to 
                 of the policy is 
                 the security policy. 
               
               
                   
                   
                   
                   
                   
                 acknowledge 
                 tracked and stored 
                 Incidents are 
               
               
                   
                   
                   
                   
                   
                 receipt. 
                 as part of the HR 
                 analyzed for 
               
               
                   
                   
                   
                   
                   
                   
                 policy of the 
                 performance 
               
               
                   
                   
                   
                   
                   
                   
                 employee. 
                 improvement to the 
               
               
                   
                   
                   
                   
                   
                   
                   
                 security awareness procedures. 
               
               
                   
                   
                 Security 
                 No education 
                 Security 
                 Security 
                 A specific party is 
                 Training plans are 
               
               
                   
                   
                 education 
                 or training is 
                 education and 
                 education is 
                 responsible for 
                 periodically reviewed 
               
               
                   
                   
                 and technical 
                 provided. 
                 technical 
                 documented and 
                 defining and 
                 to conform to the 
               
               
                   
                   
                 training 
                   
                 training are not 
                 included as part 
                 maintaining the 
                 changing needs of the 
               
               
                   
                   
                   
                   
                 provided 
                 of the hiring 
                 security education 
                 business. Training 
               
               
                   
                   
                   
                   
                 consistently and 
                 process. 
                 and technical 
                 records are reviewed 
               
               
                   
                   
                   
                   
                 the 
                 Technical 
                 training program. 
                 against policy and 
               
               
                   
                   
                   
                   
                 responsibility is 
                 training roadmaps 
                 Training records are 
                 exceptions lead to 
               
               
                   
                   
                   
                   
                 at the discretion 
                 exist for each 
                 captured in the 
                 corrective actions. 
               
               
                   
                   
                   
                   
                 of management. 
                 employee. 
                 employee&#39;s file. 
               
               
                   
                   
                   
                   
                   
                   
                 Review and 
               
               
                   
                   
                   
                   
                   
                   
                 planning for future 
               
               
                   
                   
                   
                   
                   
                   
                 training is part of 
               
               
                   
                   
                   
                   
                   
                   
                 the appraisal 
               
               
                   
                   
                   
                   
                   
                   
                 process. 
               
               
                 VI.3 
                 Responding to 
                 Disciplinary 
                 None 
                 Managers have 
                 The definition of 
                 The documented 
                 After each incident 
               
               
                   
                 Security 
                 Process for 
                 documented. 
                 intuitive 
                 violations, 
                 process includes 
                 that causes the 
               
               
                   
                 Incidents and 
                 Company 
                 Reaction is 
                 awareness of 
                 investigation 
                 roles and 
                 procedure to be 
               
               
                   
                 Malfunctions 
                 Security 
                 ad hoc. 
                 need, can quote 
                 process, and list 
                 responsibilities for 
                 invoked, the process 
               
               
                   
                   
                 Violation 
                   
                 multiple levels 
                 of applicable 
                 each step, and a 
                 is reviewed and, 
               
               
                   
                   
                   
                   
                 of penalty, 
                 penalties is 
                 clear workflow. 
                 when applicable, the 
               
               
                   
                   
                   
                   
                 including but not 
                 documented, 
                   
                 process is revised 
               
               
                   
                   
                   
                   
                 limited to firing. 
                 distributed, 
                   
                 (including the 
               
               
                   
                   
                   
                   
                 Managers and 
                 signed by the 
                   
                 training or the 
               
               
                   
                   
                   
                   
                 HR 
                 appropriate 
                   
                 penalty clauses). 
               
               
                   
                   
                   
                   
                 independently 
                 parties, and 
               
               
                   
                   
                   
                   
                 agree on how to 
                 personnel has 
               
               
                   
                   
                   
                   
                 initiate and 
                 been educated as 
               
               
                   
                   
                   
                   
                 conduct 
                 to the content. 
               
               
                   
                   
                   
                   
                 disciplinary 
               
               
                   
                   
                   
                   
                 actions. 
               
               
                 VII.1 
                 Secure Areas 
                 Protection 
                 The IT 
                 Access control is 
                 List of secure 
                 All access to secure 
                 Auditing of access 
               
               
                   
                   
                 from 
                 equipment is 
                 provided on an 
                 perimeters and 
                 IT areas is 
                 control system logs is 
               
               
                   
                   
                 unauthorized 
                 left 
                 ad hoc basis 
                 access rights to 
                 performed by a 
                 done periodically. 
               
               
                   
                   
                 access. 
                 unattended 
                 typically by IT 
                 those areas are 
                 mechanism (e.g., 
                 Changes in facilities 
               
               
                   
                   
                 Physical 
                 with no 
                 manager. No 
                 documented and 
                 badge access control 
                 and management 
               
               
                   
                   
                 entry control 
                 controls 
                 defined list of 
                 published. 
                 system) that allows 
                 trigger a review and 
               
               
                   
                   
                 to office, 
                 beyond 
                 access rights is 
                   
                 for personal 
                 revision of the access 
               
               
                   
                   
                 room. 
                 physical 
                 published or 
                   
                 identification and 
                 procedures. 
               
               
                   
                   
                 Physical 
                 building 
                 managed. 
                   
                 auditing. Access 
               
               
                   
                   
                 security for 
                 access. 
                   
                   
                 control is managed 
               
               
                   
                   
                 IT facilities. 
                   
                   
                   
                 centrally for 
               
               
                   
                   
                   
                   
                   
                   
                 granting and 
               
               
                   
                   
                   
                   
                   
                   
                 revoking rights and 
               
               
                   
                   
                   
                   
                   
                   
                 is linked to hiring 
               
               
                   
                   
                   
                   
                   
                   
                 and termination 
               
               
                   
                   
                   
                   
                   
                   
                 policies. 
               
               
                 VII.2 
                 Equipment 
                 Fire alarm 
                 The fire 
                 Procedures for 
                 The fire alarm 
                 Reaction to actual 
               
               
                   
                 Security 
                 system in not 
                 alarm system 
                 the fire alarm 
                 system is tested. 
                 alarms is reviewed 
               
               
                   
                   
                 present. 
                 exists and 
                 system are 
                 Procedures exist 
                 and improvements 
               
               
                   
                   
                   
                 people have 
                 visible and 
                 for evaluation of 
                 implemented into 
               
               
                   
                   
                   
                 been 
                 posted, 
                 the fire alarm 
                 the current system 
               
               
                   
                   
                   
                 informally 
                 including 
                 system including 
                 and alternative 
               
               
                   
                   
                   
                 made aware 
                 evacuation path, 
                 damage 
                 systems reviewed 
               
               
                   
                   
                   
                 of the 
                 behavioral 
                 assessment and 
                 where necessary. 
               
               
                   
                   
                   
                 system. 
                 actions, Halon 
                 recovery, 
               
               
                   
                   
                   
                   
                 warnings, etc. 
                 evacuation 
               
               
                   
                   
                   
                   
                   
                 headcount, etc. 
               
               
                   
                   
                 Personal 
                 No policies 
                 Policies for 
                 There is a 
                 A specific party is 
                 The personal 
               
               
                   
                   
                 workstation 
                 for personal 
                 personal 
                 documented 
                 responsible for 
                 workstation policy is 
               
               
                   
                   
                 policy 
                 workstations 
                 workstations 
                 policy for 
                 defining and 
                 regularly reviewed to 
               
               
                   
                   
                   
                 exist. 
                 exist but are not 
                 personal 
                 maintaining the 
                 ensure it conforms to 
               
               
                   
                   
                   
                   
                 published or 
                 workstations and 
                 personal 
                 the changing needs of 
               
               
                   
                   
                   
                   
                 adopted fully 
                 steps are taken to 
                 workstation 
                 the business. Personal 
               
               
                   
                   
                   
                   
                 across the 
                 spread its 
                 policy. 
                 workstation needs are 
               
               
                   
                   
                   
                   
                 organization. 
                 awareness among 
                 Sensitive 
                 reviewed and changes 
               
               
                   
                   
                   
                   
                   
                 employees. 
                 information is 
                 are made where 
               
               
                   
                   
                   
                   
                   
                   
                 protected by 
                 necessary. Audits are 
               
               
                   
                   
                   
                   
                   
                   
                 means of 
                 carried out to ensure 
               
               
                   
                   
                   
                   
                   
                   
                 encryption. 
                 that the organization 
               
               
                   
                   
                   
                   
                   
                   
                   
                 maintains a recognized 
               
               
                   
                   
                   
                   
                   
                   
                   
                 workstation policy to 
               
               
                   
                   
                   
                   
                   
                   
                   
                 ensure efficient 
               
               
                   
                   
                   
                   
                   
                   
                   
                 management. 
               
               
                   
                   
                 Protection 
                 There are no 
                 There is an 
                 There is a formal 
                 A specific party is 
                 The safety threat policy 
               
               
                   
                   
                 from 
                 procedures 
                 informal safety 
                 documented 
                 responsible for 
                 is regularly reviewed to 
               
               
                   
                   
                 environment 
                 in place to 
                 threat protection 
                 policy in place. It 
                 defining and 
                 ensure it conforms with 
               
               
                   
                   
                 al threats and 
                 protect from 
                 policy in place. 
                 details all the 
                 maintaining the 
                 the changing needs of 
               
               
                   
                   
                 hazards. 
                 safety threats 
                 This is not 
                 steps that need to 
                 safety threat 
                 the business. The 
               
               
                   
                   
                 Protection 
                 or hazards. 
                 enforced 
                 be followed to 
                 control guidelines. 
                 policy is regularly 
               
               
                   
                   
                 from human 
                   
                 throughout the 
                 protect from 
                   
                 reviewed and changes 
               
               
                   
                   
                 carelessness 
                   
                 organization and 
                 potential hazards. 
                   
                 are made where 
               
               
                   
                   
                 (eating, 
                   
                 the details of the 
                   
                   
                 necessary to ensure 
               
               
                   
                   
                 smoking, 
                   
                 policy are not 
                   
                   
                 continued compliance. 
               
               
                   
                   
                 drinking). 
                   
                 documented. 
               
               
                   
                   
                 Protection 
               
               
                   
                   
                 from power 
               
               
                   
                   
                 and 
               
               
                   
                   
                 communication 
               
               
                   
                   
                 cabling 
               
               
                   
                   
                 from 
               
               
                   
                   
                 interception 
               
               
                   
                   
                 or damage. 
               
               
                 VII.3 
                 General Controls 
                 Inspection of 
                 Incoming 
                 There is no 
                 There is a 
                 A responsible 
                 The key goods 
               
               
                   
                   
                 incoming 
                 goods are 
                 formal process 
                 documented 
                 party is identified 
                 screening process is 
               
               
                   
                   
                 goods for 
                 not 
                 to inspect 
                 process whereby 
                 to manage the 
                 regularly reviewed to 
               
               
                   
                   
                 hazards 
                 inspected. 
                 incoming goods. 
                 all incoming 
                 processes and 
                 ensure they conform to 
               
               
                   
                   
                   
                   
                 It is carried out 
                 goods are 
                 procedures for 
                 the changing needs of 
               
               
                   
                   
                   
                   
                 in an adhoc 
                 inspected per a 
                 inspecting 
                 the business. Goods 
               
               
                   
                   
                   
                   
                 manner. 
                 defined plan. 
                 incoming goods 
                 screening needs are 
               
               
                   
                   
                   
                   
                   
                   
                 for safety 
                 reviewed and changes 
               
               
                   
                   
                   
                   
                   
                   
                 compliance. 
                 are made where 
               
               
                   
                   
                   
                   
                   
                   
                   
                 necessary. The 
               
               
                   
                   
                   
                   
                   
                   
                   
                 organization maintains 
               
               
                   
                   
                   
                   
                   
                   
                   
                 historical files of 
               
               
                   
                   
                   
                   
                   
                   
                   
                 incoming goods; these 
               
               
                   
                   
                   
                   
                   
                   
                   
                 are regularly reviewed 
               
               
                   
                   
                   
                   
                   
                   
                   
                 to ensure that there are 
               
               
                   
                   
                   
                   
                   
                   
                   
                 no discrepancies. 
               
               
                   
                   
                 Process of 
                 There is no 
                 An informal 
                 A formal process 
                 An inventory of 
                 Audits of the 
               
               
                   
                   
                 removal of 
                 standardized 
                 process exists 
                 is documented 
                 organizational 
                 organization&#39;s property 
               
               
                   
                   
                 organization&#39;s 
                 procedure 
                 for property 
                 and published the 
                 property is 
                 are carried out 
               
               
                   
                   
                 property 
                 for removal 
                 removal. 
                 to organization 
                 maintained and 
                 periodically and 
               
               
                   
                   
                   
                 of property. 
                   
                 for property 
                 updated regularly. 
                 changes to the removal 
               
               
                   
                   
                   
                   
                   
                 removal. 
                 A group or 
                 process are made 
               
               
                   
                   
                   
                   
                   
                   
                 individual is 
                 where necessary. 
               
               
                   
                   
                   
                   
                   
                   
                 identified to verify 
               
               
                   
                   
                   
                   
                   
                   
                 that the process is 
               
               
                   
                   
                   
                   
                   
                   
                 followed. 
               
               
                   
                   
                 Equipment 
                 There are no 
                 Equipment 
                 Equipment is 
                 A responsible 
                 Record of equipment 
               
               
                   
                   
                 maintenance 
                 equipment 
                 maintenance is 
                 covered by 
                 party is identified 
                 maintenance is 
               
               
                   
                   
                   
                 maintenance 
                 carried out on an 
                 insurance and the 
                 to oversee 
                 examined to determine 
               
               
                   
                   
                   
                 policies and 
                 ad hoc basis 
                 equipment 
                 equipment 
                 fault patterns or abuses. 
               
               
                   
                   
                   
                 the 
                 based on 
                 maintenance 
                 maintenance 
                 Appropriate changes 
               
               
                   
                   
                   
                 equipment 
                 manufacturer 
                 controls the 
                 policies are 
                 are incorporated into 
               
               
                   
                   
                   
                 maintenance 
                 recommended 
                 determination of 
                 followed. 
                 the maintenance 
               
               
                   
                   
                   
                 is done only 
                 service intervals 
                 risk. 
                   
                 policies. 
               
               
                   
                   
                   
                 on failure. 
               
               
                   
                   
                 Sensitive 
                 Data 
                 Data disposal 
                 Data disposal 
                 A responsible 
                 The disposal procedure 
               
               
                   
                   
                 data disposal 
                 disposal 
                 procedure is 
                 procedure is 
                 party is identified 
                 is audited regularly and 
               
               
                   
                   
                 procedure 
                 procedure is 
                 informally 
                 formally defined 
                 to oversee that the 
                 appropriate steps 
               
               
                   
                   
                   
                 not defined. 
                 defined. 
                 and published to 
                 disposal procedure 
                 incorporated into the 
               
               
                   
                   
                   
                   
                   
                 the organization. 
                 is followed. 
                 procedure. 
               
               
                 VIII.1 
                 Operational 
                 Management 
                 None - each 
                 Common 
                 Documented in 
                 Roles and 
                 Procedures include a 
                 Reporting 
               
               
                   
                 Procedures and 
                 Responsibilities 
                 incident is 
                 awareness of 
                 writing and made 
                 responsibilities are 
                 mechanism to evolve 
                 procedures 
               
               
                   
                 Responsibilities 
                 and 
                 handled ad 
                 procedures. 
                 available to all IT 
                 defined. 
                 them. Incidents are 
                 cover: 
               
               
                   
                   
                 Procedures 
                 hoc on a best 
                 Effort for 
                 staff (and other 
                 Escalation and 
                 analyzed to suggest 
                 All types of 
               
               
                   
                   
                 Incident 
                 effort basis. 
                 repeatability 
                 department staff 
                 reporting chains 
                 improvements. There 
                 security 
               
               
                   
                   
                 Reporting 
                   
                 includes staff 
                 with IT roles) 
                 exist. Issues and 
                 is a quality 
                 incident 
               
               
                   
                   
                 Procedures 
                   
                 meetings, 
                   
                 requests are 
                 improvement process, 
                 Contingency 
               
               
                   
                   
                   
                   
                 training 
                   
                 recorded as 
                 documented and 
                 plans 
               
               
                   
                   
                   
                   
                 sessions, 
                   
                 trouble tickets. 
                 applied. 
                 Audit trails 
               
               
                   
                   
                   
                   
                 coaching 
                   
                   
                   
                 and similar 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Recover actions and authority 
               
               
                 VIII.2 
                 System Planning 
                 Testing of 
                 None; new 
                 Testing is 
                 A formal 
                 The responsibility 
                 Policy is 
                 Includes issues 
               
               
                   
                 and Acceptance 
                 new 
                 systems are 
                 informal and is 
                 document 
                 to define, review, 
                 periodically 
                 of capacity 
               
               
                   
                   
                 information 
                 placed in 
                 performed based 
                 defining the 
                 and ensure 
                 reviewed and 
                 planning and 
               
               
                   
                   
                 systems 
                 operation 
                 on individuals&#39; 
                 testing and 
                 compliance with 
                 revised upon any 
                 Systems 
               
               
                   
                   
                 requirements 
                 without any 
                 knowledge, not 
                 deployment of 
                 the testing policy 
                 change in the 
                 Acceptance. 
               
               
                   
                   
                 and upgrades 
                 formal test 
                 on a formal 
                 new and 
                 is defined. There 
                 production systems 
                 Issues to be 
               
               
                   
                   
                 prior to 
                 procedure. 
                 process. 
                 upgraded systems 
                 are system level 
                 or organizational 
                 considered 
               
               
                   
                   
                 deployment 
                   
                   
                 is defined. 
                 tools that prevent 
                 structure. Testing 
                 include: 
               
               
                   
                   
                   
                   
                   
                   
                 unauthorized 
                 methodology and 
                 Performance 
               
               
                   
                   
                   
                   
                   
                   
                 changes to 
                 tools are 
                 and Computer 
               
               
                   
                   
                   
                   
                   
                   
                 production 
                 continuously 
                 Capacity 
               
               
                   
                   
                   
                   
                   
                   
                 systems. 
                 examined to 
                 Requirements 
               
               
                   
                   
                   
                   
                   
                   
                 Documents exist 
                 determine 
                 Error Recovery 
               
               
                   
                   
                   
                   
                   
                   
                 detailing 
                 applicability to the 
                 and Restart 
               
               
                   
                   
                   
                   
                   
                   
                 interfaces into the 
                 organization and 
                 Procedures 
               
               
                   
                   
                   
                   
                   
                   
                 change 
                 then introduced. 
                 Security 
               
               
                   
                   
                   
                   
                   
                   
                 management 
                   
                 Controls/Issues 
               
               
                   
                   
                   
                   
                   
                   
                 process. 
                   
                 Manual 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Processes 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Business 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Continuity 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Arrangements 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Additional 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Load on existing machines 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 Training in the 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 operation of the new equipment 
               
               
                 VIII.3 
                 Protection 
                 Detection and 
                 No 
                 IT staff has 
                 A formal, 
                 A specific party is 
                 The procedure 
                 Procedures 
               
               
                   
                 Against 
                 protection 
                 detection, 
                 informally 
                 documented 
                 responsible for 
                 includes a 
                 cover: 
               
               
                   
                 Malicious 
                 against 
                 protection 
                 defined 
                 procedure for 
                 defining and 
                 mechanism for 
                 All types of 
               
               
                   
                 Software 
                 malicious 
                 measures, 
                 procedures for 
                 detecting and 
                 maintaining the 
                 evolution. Incidents 
                 virus and 
               
               
                   
                   
                 software. 
                 reporting, 
                 detecting and 
                 handling 
                 detection and 
                 are analyzed to 
                 malicious 
               
               
                   
                   
                 User 
                 or recovery 
                 handling 
                 malicious 
                 protection 
                 suggest 
                 software 
               
               
                   
                   
                 awareness of 
                 procedures 
                 malicious 
                 software and 
                 procedures, 
                 improvements. The 
                 incident 
               
               
                   
                   
                 procedures to 
                 exist, and 
                 software and 
                 virus attacks 
                 informing and 
                 toolset is 
                 Contingency 
               
               
                   
                   
                 deal with 
                 dealing 
                 virus attacks. 
                 exists and is 
                 training the users, 
                 continuously 
                 plans 
               
               
                   
                   
                 malicious 
                 with 
                 There are no 
                 communicated to 
                 managing the 
                 examined and 
                 Audit trails and 
               
               
                   
                   
                 software 
                 malicious 
                 common tools, 
                 all employees as 
                 detection and 
                 updated to provide 
                 similar 
               
               
                   
                   
                 Procedures 
                 software 
                 formal 
                 part of the 
                 recovery efforts, 
                 maximum protection 
                 Recover actions 
               
               
                   
                   
                 for reporting 
                 and virus 
                 documentation, 
                 corporate security 
                 and selecting and 
                 against changing 
                 and authority 
               
               
                   
                   
                 and recovery 
                 attacks is 
                 or training 
                 policy. A 
                 maintaining the 
                 treats. 
               
               
                   
                   
                 from virus 
                 entirely 
                 programs for all 
                 standard set of 
                 protective tools. 
               
               
                   
                   
                 attacks 
                 reactive 
                 employees. 
                 protective tools is 
               
               
                   
                   
                   
                 and 
                   
                 defined and 
               
               
                   
                   
                   
                 handled in 
                   
                 deployed. 
               
               
                   
                   
                   
                 an ad hoc 
                   
                 Training is given 
               
               
                   
                   
                   
                 manner. 
                   
                 to all employees. 
               
               
                   
                   
                 Policy 
                 No policy 
                 Software 
                 A software 
                 A specific party is 
                 List of authorized 
               
               
                   
                   
                 relating to 
                 or 
                 monitoring 
                 licensing policy 
                 responsible for 
                 software is 
               
               
                   
                   
                 licensed 
                 monitoring 
                 policies are 
                 is documented 
                 monitoring and 
                 periodically 
               
               
                   
                   
                 software and 
                 exists 
                 informal and 
                 and published to 
                 maintaining 
                 reviewed to conform 
               
               
                   
                   
                 prohibition of 
                 regarding 
                 performed on an 
                 all employees. 
                 authorized 
                 to the changing 
               
               
                   
                   
                 unauthorized 
                 software 
                 ad hoc basis. The 
                   
                 software licenses 
                 needs of the 
               
               
                   
                   
                 software 
                 installation 
                 IT organization, 
                   
                 for the enterprise. 
                 business. Software 
               
               
                   
                   
                   
                   
                 when involved in 
                   
                 A software 
                 audits are reviewed 
               
               
                   
                   
                   
                   
                 software 
                   
                 inventory 
                 and exceptions lead 
               
               
                   
                   
                   
                   
                 procurement, 
                   
                 licensing tool is 
                 to corrective actions. 
               
               
                   
                   
                   
                   
                 applies controls 
                   
                 used to monitor 
               
               
                   
                   
                   
                   
                 informally. 
                   
                 and ensure compliance. 
               
               
                 VIII.4 
                 Housekeeping 
                 Monitoring of 
                 No 
                 Informal 
                 Capacity plan and 
                 Ownership of the 
                 New technology, 
               
               
                   
                   
                 processing 
                 monitoring 
                 monitoring as 
                 capacity 
                 capacity plan and 
                 contractual 
               
               
                   
                   
                 power and 
                 exists. 
                 part of system 
                 management 
                 capacity 
                 agreements, and 
               
               
                   
                   
                 storage to 
                 Capacity 
                 management 
                 process covering 
                 management 
                 supplier selection 
               
               
                   
                   
                 ensure 
                 adjustments 
                 procedures 
                 processing 
                 process is defined. 
                 are continuously 
               
               
                   
                   
                 availability 
                 are 
                 performed on an 
                 power, memory, 
                 Formal 
                 researched and 
               
               
                   
                   
                   
                 performed 
                 as needed basis. 
                 disc space, 
                 mechanism for 
                 introduced into the 
               
               
                   
                   
                   
                 in reaction 
                 No management 
                 LAN/WAN 
                 business managers 
                 environment in 
               
               
                   
                   
                   
                 to 
                 capacity plan or 
                 capacity, backup 
                 to place 
                 order to provide the 
               
               
                   
                   
                   
                 problems. 
                 model is 
                 capacity, number 
                 requirements into 
                 necessary resources 
               
               
                   
                   
                   
                   
                 specifically 
                 of user 
                 the plan and a link 
                 while optimizing the 
               
               
                   
                   
                   
                   
                 defined. 
                 workstations, 
                 exists between the 
                 costs. 
               
               
                   
                   
                   
                   
                   
                 physical space 
                 capacity planning 
               
               
                   
                   
                   
                   
                   
                 and power. 
                 process and the 
               
               
                   
                   
                   
                   
                   
                   
                 budgeting process. 
               
               
                 VIII.5 
                 Network 
                 Covered by other 
               
             
          
           
               
                   
                 Management 
                 questions in this section 
               
             
          
           
               
                 VIII.6 
                 Media Handling 
                 Procedures 
                 No 
                 IT staff has 
                 Formal, 
                 A specific party is 
                 Procedures are 
                 Media includes: 
               
               
                   
                 and Security 
                 and controls 
                 procedures 
                 informally 
                 documented 
                 responsible for 
                 periodically 
                 IT computer 
               
               
                   
                   
                 to protect 
                 or controls 
                 defined 
                 procedures for 
                 defining and 
                 reviewed to address 
                 room media 
               
               
                   
                   
                 computer 
                 are in place 
                 procedures and 
                 protecting 
                 maintaining the 
                 changes in the type 
                 (e.g., backup 
               
               
                   
                   
                 media 
                 to protect 
                 controls for 
                 computer media 
                 procedures for the 
                 or volume of 
                 tapes, 
               
               
                   
                   
                   
                 computer 
                 protecting 
                 exist and are 
                 access control 
                 computer media to 
                 removable hard 
               
               
                   
                   
                   
                 media. 
                 computer media. 
                 communicated to 
                 systems and 
                 be handled. Audit 
                 drives, CD- 
               
               
                   
                   
                   
                   
                 There is no 
                 all employees as 
                 auditing of access 
                 logs are reviewed 
                 ROMs, etc.) 
               
               
                   
                   
                   
                   
                 formal 
                 part of the 
                 to computer media. 
                 and exceptions lead 
                 User media 
               
               
                   
                   
                   
                   
                 documentation, 
                 corporate security 
                   
                 to corrective action. 
                 (e.g., CD- 
               
               
                   
                   
                   
                   
                 access logs, or 
                 policy. Controls 
                   
                   
                 ROMs, floppy 
               
               
                   
                   
                   
                   
                 training programs 
                 are in place to 
                   
                   
                 discs, etc.) 
               
               
                   
                   
                   
                   
                 for all employees. 
                 limit and track 
               
               
                   
                   
                   
                   
                   
                 access to media. 
               
               
                   
                   
                   
                   
                   
                 Training is given 
               
               
                   
                   
                   
                   
                   
                 to all employees. 
               
               
                 VIII.7 
                 Exchanges of 
                 Security of 
                 No defined 
                 No corporate 
                 A corporate 
                 A specific party is 
                 The standards are 
                 Standards for 
               
               
                   
                 Information and 
                 exchange of 
                 procedures 
                 standard or policy 
                 standard for the 
                 responsible for 
                 periodically 
                 secure 
               
               
                   
                 Software 
                 data and 
                 to secure 
                 exists addressing 
                 security exchange 
                 defining and 
                 reviewed to address 
                 exchange of 
               
               
                   
                   
                 software with 
                 the 
                 securing the 
                 of data and 
                 maintaining the 
                 changes to the data 
                 data and 
               
               
                   
                   
                 other 
                 exchange 
                 exchange of data 
                 software with 
                 standards for the 
                 being exchanged or 
                 software with 
               
               
                   
                   
                 organizations. 
                 of data or 
                 and software with 
                 other 
                 secure exchange 
                 the means of 
                 3rd parties and 
               
               
                   
                   
                   
                 software. 
                 other 
                 organizations is 
                 of data and 
                 exchanging. The 
                 outsourcing 
               
               
                   
                   
                   
                   
                 organizations. 
                 documented and 
                 software. An 
                 information 
                 vendors. 
               
               
                   
                   
                   
                   
                   
                 published to all 
                 information 
                 classification policy 
                 Information 
               
               
                   
                   
                   
                   
                   
                 employees. 
                 classification 
                 continually evolves. 
                 classification policy 
               
               
                   
                   
                   
                   
                   
                   
                 policy determines 
               
               
                   
                   
                   
                   
                   
                   
                 what can be and 
               
               
                   
                   
                   
                   
                   
                   
                 how it is transmitted. 
               
               
                 IX.1 
                 Business 
                 Documentation 
                 No 
                 An informal, 
                 An access policy 
                 A specific party is 
                 The access policy 
                 Access rights 
               
               
                   
                 Requirements 
                 of business 
                 awareness 
                 undocumented 
                 statement 
                 responsible for 
                 statement is 
                 encompasses 
               
               
                   
                 for Access 
                 requirements 
                 or practice 
                 access control 
                 defining access 
                 defining and 
                 periodically 
                 accounts for 
               
               
                   
                 Control 
                 for access 
                 of access 
                 practice is 
                 rights of each 
                 maintaining the 
                 reviewed to conform 
                 network, 
               
               
                   
                   
                 control. 
                 control. 
                 applied on an ad 
                 user or group of 
                 access policy 
                 to the changing 
                 operating 
               
               
                   
                   
                 Access policy 
                   
                 hoc basis. 
                 users exists and is 
                 statement and 
                 needs of the 
                 system, and 
               
               
                   
                   
                 statement 
                   
                   
                 published. 
                 ensuring it is in 
                 business. Security 
                 application 
               
               
                   
                   
                 defining the 
                   
                   
                   
                 alignment with 
                 incidents are 
                 access. 
               
               
                   
                   
                 access right of 
                   
                   
                   
                 business 
                 reviewed and 
                 ACLs, user and system 
               
               
                   
                   
                 each user or 
                   
                   
                   
                 requirements. 
                 modifications to the 
                 accounts, etc. 
               
               
                   
                   
                 group of users. 
                   
                   
                   
                   
                 access policy 
                 Automatic identification of 
               
               
                   
                   
                 Protection of 
                   
                   
                   
                   
                 statement are made 
                 terminals and portable 
               
               
                   
                   
                 connected 
                   
                   
                   
                   
                 where appropriate. 
                 devices. Timeout of 
               
               
                   
                   
                 services from 
                   
                   
                   
                   
                   
                 remote systems 
               
               
                   
                   
                 unauthorized 
                   
                   
                   
                   
                   
                 left unattended 
               
               
                   
                   
                 use. 
                   
                   
                   
                   
                   
                 for extended 
               
               
                   
                   
                 Review of user 
                   
                   
                   
                   
                   
                 periods of time 
               
               
                   
                   
                 access right 
               
               
                   
                   
                 and 
               
               
                   
                   
                 capabilities 
               
               
                   
                   
                 Policy 
               
               
                   
                   
                 concerning the 
               
               
                   
                   
                 use of network 
               
               
                   
                   
                 and network 
               
               
                   
                   
                 services. 
               
               
                   
                   
                 Network 
               
               
                   
                   
                 controls in 
               
               
                   
                   
                 place 
               
               
                 IX.2 
                 User Access 
                 System of 
                 No 
                 An informal, 
                 A user account 
                 A specific party is 
                 The user account 
                 Deletion vs. 
               
               
                   
                 Management 
                 formal 
                 control 
                 undocumented 
                 policy defining 
                 responsible for 
                 policy is 
                 disabling 
               
               
                   
                   
                 registration/de- 
                 over 
                 user account 
                 access rights, 
                 defining and 
                 periodically 
                 accounts. 
               
               
                   
                   
                 registration for 
                 access to 
                 practice is 
                 privilege levels, 
                 maintaining the 
                 reviewed to conform 
                 Unique id for 
               
               
                   
                   
                 access to IT 
                 IT 
                 applied on an ad 
                 and 
                 user account 
                 to the changing 
                 all users. 
               
               
                   
                   
                 services. 
                 services. 
                 hoc basis. 
                 creation/deletion 
                 policy. User 
                 needs of the 
               
               
                   
                   
                 Immediate 
                   
                   
                 rules exists and is 
                 account 
                 business. Audit 
               
               
                   
                   
                 account 
                   
                   
                 published. 
                 creation/deletion 
                 requirements are 
               
               
                   
                   
                 removal for 
                   
                   
                   
                 records are 
                 reviewed and 
               
               
                   
                   
                 users who 
                   
                   
                   
                 archived. 
                 modifications to the 
               
               
                   
                   
                 change duties 
                   
                   
                   
                   
                 user account policy 
               
               
                   
                   
                 or leave the 
                   
                   
                   
                   
                 are made where 
               
               
                   
                   
                 company. 
                   
                   
                   
                   
                 appropriate. 
               
               
                   
                   
                 User&#39;s 
                   
                   
                   
                   
                 Multiple accounts 
               
               
                   
                   
                 privilege in 
                   
                   
                   
                   
                 per individual are 
               
               
                   
                   
                 overriding 
                   
                   
                   
                   
                 created or deleted 
               
               
                   
                   
                 system/application 
                   
                   
                   
                   
                 through a single 
               
               
                   
                   
                 restriction. 
                   
                   
                   
                   
                 point of control. 
               
               
                   
                   
                 Record kept of 
               
               
                   
                   
                 all privileges 
               
               
                   
                   
                 allocated. 
               
               
                   
                   
                 System routine 
               
               
                   
                   
                 to grant 
               
               
                   
                   
                 privilege to 
               
               
                   
                   
                 users. 
               
               
                   
                   
                 Access control 
               
               
                   
                   
                 to program 
               
               
                   
                   
                 source library 
               
               
                 IX.3 
                 User 
                 Security of user 
                 Passwords 
                 An informal, 
                 A published 
                 A specific party 
                 The password policy is 
                 Limit the number 
               
               
                   
                 Responsibilities 
                 password. User 
                 are not 
                 undocumented 
                 password 
                 is responsible 
                 periodically reviewed 
                 of password 
               
               
                   
                   
                 password 
                 used. 
                 password 
                 policy defines 
                 for defining and 
                 to conform to the 
                 attempt before 
               
               
                   
                   
                 confidentiality 
                   
                 practice is 
                 password 
                 maintaining the 
                 changing needs of the 
                 the system locks 
               
               
                   
                   
                 level 
                   
                 applied on an 
                 strength (e.g., 
                 password policy. 
                 business. Periodic 
                 out the user. 
               
               
                   
                   
                   
                   
                 ad hoc basis. 
                 length, 
                 Record of 
                 audits (cracking) of 
                 Record and make 
               
               
                   
                   
                   
                   
                   
                 inclusion of 
                 password 
                 passwords are 
                 user aware of 
               
               
                   
                   
                   
                   
                   
                 special 
                 histories is 
                 performed to ensure 
                 unsuccessful 
               
               
                   
                   
                   
                   
                   
                 characters), 
                 archived. 
                 compliance and 
                 logon attempts 
               
               
                   
                   
                   
                   
                   
                 aging, and 
                   
                 exceptions are noted, 
                 Enforcement of 
               
               
                   
                   
                   
                   
                   
                 usage. 
                   
                 documented, and 
                 password rules 
               
               
                   
                   
                   
                   
                   
                   
                   
                 corrective action is taken. 
               
               
                   
                   
                 Good-practice 
                 No 
                 An informal, 
                 A good-practice 
                 A specific party 
                 A process exists to 
                 No display of 
               
               
                   
                   
                 guidelines to 
                 guidelines 
                 undocumented 
                 guidelines 
                 is responsible 
                 solicit suggestions for 
                 system identifiers 
               
               
                   
                   
                 users in 
                 exist. 
                 guidelines is 
                 statement is 
                 for defining and 
                 best-practice guidelines 
                 until logon has 
               
               
                   
                   
                 ensuring good 
                   
                 provided to 
                 defined and 
                 maintaining the 
                 from internal and 
                 been successful 
               
               
                   
                   
                 security. 
                   
                 users on an ad 
                 incorporated 
                 good-practice 
                 external sources and to 
                 General notice 
               
               
                   
                   
                   
                   
                 hoc basis. 
                 into user 
                 guidelines. 
                 incorporate them into 
                 warning that the 
               
               
                   
                   
                   
                   
                   
                 training 
                   
                 the organization&#39;s user 
                 system should 
               
               
                   
                   
                   
                   
                   
                 programs. 
                   
                 security guidelines. 
                 only be used by 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 authorized users 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 If error occurs at 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 logon do not 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 indicate what the 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 error was 
               
               
                   
                   
                 Cryptographic 
                 No 
                 An informal, 
                 A good-practice 
                 A specific party 
                 A process exists to 
               
               
                   
                   
                 Controls 
                 guidelines 
                 undocumented 
                 guidelines 
                 is responsible 
                 solicit suggestions for 
               
               
                   
                   
                   
                 exist. 
                 guidelines is 
                 statement is 
                 for defining and 
                 best-practice guidelines 
               
               
                   
                   
                   
                   
                 provided to 
                 defined and 
                 maintaining the 
                 from internal and 
               
               
                   
                   
                   
                   
                 users on an ad 
                 incorporated 
                 good-practice 
                 external sources and to 
               
               
                   
                   
                   
                   
                 hoc basis. 
                 into user 
                 guidelines. 
                 incorporate them into 
               
               
                   
                   
                   
                   
                   
                 training 
                   
                 the organization&#39;s user 
               
               
                   
                   
                   
                   
                   
                 programs. The 
                   
                 security guidelines. 
               
               
                   
                   
                   
                   
                   
                 guidelines 
               
               
                   
                   
                   
                   
                   
                 cover: 
               
               
                   
                   
                   
                   
                   
                 encryption, 
               
               
                   
                   
                   
                   
                   
                 digital 
               
               
                   
                   
                   
                   
                   
                 signatures, key 
               
               
                   
                   
                   
                   
                   
                 management, 
               
               
                   
                   
                   
                   
                   
                 non-repudiation 
               
               
                   
                   
                   
                   
                   
                 services 
               
             
          
           
               
                 IX.4 
                 Network 
                 Covered in other area in this 
               
               
                   
                 Access Control 
                 section 
               
               
                 IX.5 
                 Operating 
                 Covered in other area in this 
               
               
                   
                 System Access 
                 section 
               
               
                   
                 Control 
               
               
                 IX.6 
                 Application 
                 Covered in other area in this 
               
               
                   
                 Access Control 
                 section 
               
               
                 IX.7 
                 Monitoring 
                 Covered in other area in this 
               
               
                   
                 System Access 
                 section 
               
               
                   
                 and Use 
               
             
          
           
               
                 IX.8 
                 Mobile 
                 Mobile 
                 No 
                 An informal, 
                 A good-practice 
                 A specific party 
                 A process exists to 
                 Laptop, Mobile, 
               
               
                   
                 Computing and 
                 Computing and 
                 guidelines 
                 undocumented 
                 guidelines 
                 is responsible 
                 solicit suggestions for 
                 and Palmtop 
               
               
                   
                 Teleworking 
                 Teleworking 
                 exist. 
                 guidelines is 
                 statement is 
                 for defining and 
                 best-practice guidelines 
                 security to ensure 
               
               
                   
                   
                   
                   
                 provided to 
                 defined and 
                 maintaining the 
                 from internal and 
                 company 
               
               
                   
                   
                   
                   
                 users on an ad 
                 incorporated 
                 good-practice 
                 external sources and to 
                 information is not 
               
               
                   
                   
                   
                   
                 hoc basis. 
                 into user 
                 guidelines. 
                 incorporate them into 
                 compromised. 
               
               
                   
                   
                   
                   
                   
                 training 
                   
                 the organization&#39;s user 
               
               
                   
                   
                   
                   
                   
                 programs. 
                   
                 security guidelines. 
               
               
                 X.1 
                 Security 
                 Risk 
                 There is no 
                 An informal 
                 A published 
                 A specific party 
                 The risk assessment 
               
               
                   
                 Requirements 
                 assessment and 
                 framework 
                 undocumented 
                 risk assessment 
                 is responsible 
                 and risk management 
               
               
                   
                 of Systems 
                 risk 
                 of risk 
                 risk 
                 and risk 
                 for defining and 
                 policies are 
               
               
                   
                   
                 management 
                 assessment. 
                 assessment 
                 management 
                 maintaining the 
                 periodically reviewed 
               
               
                   
                   
                 used for 
                   
                 and risk 
                 procedure 
                 risk assessment 
                 to conform to the 
               
               
                   
                   
                 analyzing 
                   
                 management 
                 exists. 
                 and risk 
                 changing needs of the 
               
               
                   
                   
                 security 
                   
                 practice is 
                   
                 management 
                 business. Changes are 
               
               
                   
                   
                 requirement 
                   
                 applied on an 
                   
                 guidelines. 
                 made to the policy 
               
               
                   
                   
                   
                   
                 ad-hoc basis. 
                   
                 An archive is 
                 where required. 
               
               
                   
                   
                   
                   
                   
                   
                 kept of the risks 
               
               
                   
                   
                   
                   
                   
                   
                 identified and 
               
               
                   
                   
                   
                   
                   
                   
                 the action taken 
               
               
                   
                   
                   
                   
                   
                   
                 to manage the 
               
               
                   
                   
                   
                   
                   
                   
                 risk. 
               
               
                   
                   
                 Safety check 
                 No safety 
                 An informal 
                 There is a 
                 A specific party 
                 The safety checks are 
               
               
                   
                   
                 while procuring 
                 checks are 
                 procedure 
                 documented 
                 is responsible 
                 regularly reviewed to 
               
               
                   
                   
                 new program 
                 carried out 
                 exists whereby 
                 procedure that 
                 for defining and 
                 ensure that they 
               
               
                   
                   
                 and software 
                 when 
                 new programs 
                 is followed 
                 maintaining the 
                 conform to the 
               
               
                   
                   
                   
                 procuring 
                 and software 
                 before any 
                 software safety 
                 changing needs of the 
               
               
                   
                   
                   
                 new 
                 are assessed 
                 software is 
                 check 
                 business. There is a 
               
               
                   
                   
                   
                 software. 
                 before being 
                 purchased. 
                 guidelines. 
                 regular risk analysis is 
               
               
                   
                   
                   
                   
                 put in to the 
                 This ensures 
                 Modifications to 
                 carried out to ensure 
               
               
                   
                   
                   
                   
                 operational 
                 that all software 
                 vendor supplied 
                 safety of existing 
               
               
                   
                   
                   
                   
                 environment. 
                 purchased 
                 packages are 
                 systems and 
               
               
                   
                   
                   
                   
                 This task in 
                 conforms to 
                 made to comply 
                 compromise to their 
               
               
                   
                   
                   
                   
                 performed on 
                 company 
                 with system 
                 security is controlled. 
               
               
                   
                   
                   
                   
                 an ad-hoc 
                 security 
                 requirements 
                 Emphasis is given on 
               
               
                   
                   
                   
                   
                 basis. 
                 guidelines. 
                 and vendor 
                 quality certification of 
               
               
                   
                   
                   
                   
                   
                   
                 consent is 
                 new products. 
               
               
                   
                   
                   
                   
                   
                   
                 obtained before 
               
               
                   
                   
                   
                   
                   
                   
                 doing so. 
               
               
                 X.2 
                 Security in 
                 Validation 
                 There is no 
                 An informal 
                 There is a 
                 A specific party 
                 The validation control 
               
               
                   
                 Application 
                 control while 
                 validation 
                 process exists 
                 published 
                 is responsible 
                 procedure is regularly 
               
               
                   
                 Systems 
                 data input to 
                 of 
                 where data is 
                 standard which 
                 for defining and 
                 reviewed to ensure that 
               
               
                   
                   
                 application 
                 information 
                 both verified 
                 describes the 
                 maintaining the 
                 they conform to the 
               
               
                   
                   
                 system 
                 on 
                 before it is 
                 validation tests 
                 validation 
                 changing needs of the 
               
               
                   
                   
                 Data validation 
                 application 
                 entered in to 
                 that are 
                 control 
                 business. Periodic 
               
               
                   
                   
                 of stored 
                 systems. 
                 applications 
                 performed. 
                 guidelines. 
                 audits are performed of 
               
               
                   
                   
                 information 
                   
                 and existing 
                 There is a 
                   
                 data on application 
               
               
                   
                   
                 Output Data 
                   
                 data is 
                 documented 
                   
                 systems to ensure 
               
               
                   
                   
                 Validation 
                   
                 verified. Basic 
                 process which 
                   
                 compliance. 
               
               
                   
                   
                   
                   
                 tests like 
                 is followed. 
                   
                 Exceptions are noted, 
               
               
                   
                   
                   
                   
                 missing or 
                   
                   
                 documented and 
               
               
                   
                   
                   
                   
                 incomplete 
                   
                   
                 corrective action is 
               
               
                   
                   
                   
                   
                 data, invalid 
                   
                   
                 taken. 
               
               
                   
                   
                   
                   
                 characters in 
               
               
                   
                   
                   
                   
                 fields are 
               
               
                   
                   
                   
                   
                 performed on 
               
               
                   
                   
                   
                   
                 an ad-hoc 
               
               
                   
                   
                   
                   
                 basis. 
               
               
                 X.3 
                 Cryptographic 
                 Cryptographic 
                 There are 
                 There is an 
                 There is a 
                 A specific party 
                 The cryptographic 
               
               
                   
                 Controls 
                 control 
                 no 
                 informal 
                 documented 
                 is responsible 
                 controls are regularly 
               
               
                   
                   
                   
                 cryptographic 
                 practice 
                 procedure 
                 for defining and 
                 reviewed to ensure that 
               
               
                   
                   
                   
                 controls 
                 employed 
                 which defines 
                 maintaining the 
                 they conform to the 
               
               
                   
                   
                   
                 or existing 
                 whereby some 
                 the steps which 
                 cryptography 
                 changing needs of the 
               
               
                   
                   
                   
                 system 
                 files are 
                 outlines which 
                 control 
                 business. Audits are 
               
               
                   
                   
                   
                 architecture 
                 encrypted. 
                 document 
                 guidelines. 
                 carried regularly to 
               
               
                   
                   
                   
                 does not 
                 This is done at 
                 classifications 
                 Separate key 
                 ensure that information 
               
               
                   
                   
                   
                 support 
                 the user 
                 need to be 
                 management 
                 that should be 
               
               
                   
                   
                   
                 cryptography. 
                 discretion and 
                 encrypted and 
                 procedures are 
                 encrypted is kept 
               
               
                   
                   
                   
                   
                 on an ad-hoc 
                 the process to 
                 used for digital 
                 encrypted and that the 
               
               
                   
                   
                   
                   
                 basis. 
                 be followed to 
                 signatures and 
                 encryption method 
               
               
                   
                   
                   
                   
                   
                 achieve this. 
                 encryption. 
                 used is adequate. 
               
               
                   
                   
                 Vulnerabilities 
                 There are 
                 There is a 
                 There is a 
                 A specific party 
                 The key management 
               
               
                   
                   
                 of 
                 no key 
                 process in 
                 documented 
                 is responsible 
                 system is regularly 
               
               
                   
                   
                 cryptographic 
                 management 
                 place where by 
                 key 
                 for defining and 
                 reviewed to ensure 
               
               
                   
                   
                 keys. 
                 procedures. 
                 suitable key 
                 management 
                 maintaining the 
                 they conform to the 
               
               
                   
                   
                 Key 
                   
                 management 
                 system which 
                 key management 
                 changing needs of the 
               
               
                   
                   
                 management 
                   
                 exists, based 
                 defines the 
                 system. 
                 business. Key 
               
               
                   
                   
                 system. 
                   
                 upon an 
                 steps to be 
                 Separate key 
                 management needs are 
               
               
                   
                   
                 Documentation 
                   
                 informal set of 
                 followed. This 
                 management 
                 reviewed and changes 
               
               
                   
                   
                 of key 
                   
                 standards, 
                 ensures that the 
                 procedures are 
                 are made where 
               
               
                   
                   
                 management 
                   
                 procedures and 
                 type of 
                 used for digital 
                 necessary. Audits are 
               
               
                   
                   
                 system 
                   
                 secure 
                 algorithm and 
                 signatures and 
                 carried out to ensure 
               
               
                   
                   
                 (activation &amp; 
                   
                 methods. 
                 length of keys 
                 encryption. 
                 that the organization 
               
               
                   
                   
                 de-activation 
                   
                   
                 are considered 
                 Cryptographic 
                 maintains a recognized 
               
               
                   
                   
                 date, certificate 
                   
                   
                 to identify level 
                 keys have 
                 certification authority 
               
               
                   
                   
                 information) 
                   
                   
                 of 
                 defined 
                 to ensure key 
               
               
                   
                   
                   
                   
                   
                 cryptographic 
                 activation and 
                 protection and efficient 
               
               
                   
                   
                   
                   
                   
                 protection 
                 deactivation 
                 key management. 
               
               
                   
                   
                   
                   
                   
                   
                 dates. All keys 
               
               
                   
                   
                   
                   
                   
                   
                 are protected 
               
               
                   
                   
                   
                   
                   
                   
                 against 
               
               
                   
                   
                   
                   
                   
                   
                 modification and 
               
               
                   
                   
                   
                   
                   
                   
                 destruction in 
               
               
                   
                   
                   
                   
                   
                   
                 case of private 
               
               
                   
                   
                   
                   
                   
                   
                 key 
               
               
                   
                   
                   
                   
                   
                   
                 compromise. 
               
               
                 X.4 
                 Security of 
                 Protection and 
                 No change 
                 An informal 
                 There is a 
                 A specific party 
                 The change control 
               
               
                   
                 System Files 
                 control of 
                 control 
                 procedure 
                 documented 
                 is responsible 
                 policy is regularly 
               
               
                   
                   
                 system test 
                 procedure 
                 exists for 
                 standard 
                 for defining and 
                 reviewed to ensure 
               
               
                   
                   
                 data. 
                 in place and 
                 change 
                 available to 
                 maintaining the 
                 that it conforms to 
               
               
                   
                   
                 Change control 
                 no 
                 control. This 
                 employs 
                 change control 
                 the changing needs 
               
               
                   
                   
                 procedure 
                 provisions 
                 task is 
                 describing the 
                 guidelines. 
                 of the business. 
               
               
                   
                   
                 Control of 
                 for the 
                 performed on 
                 procedures to 
                 Version control 
                 Version control 
               
               
                   
                   
                 operational 
                 protection 
                 an ad-hoc 
                 follow to ensure 
                 for software 
                 logs are audited and 
               
               
                   
                   
                 software 
                 of system 
                 basis. 
                 that the change 
                 update is 
                 any exceptions are 
               
               
                   
                   
                   
                 test data. 
                   
                 control 
                 maintained and 
                 documented, noted 
               
               
                   
                   
                   
                   
                   
                 procedures are 
                 archives are kept 
                 and corrective 
               
               
                   
                   
                   
                   
                   
                 followed 
                 of all versions. 
                 action is taken if 
               
               
                   
                   
                   
                   
                   
                 correctly 
                   
                 necessary. 
               
               
                 X.5 
                 Security in 
                 Awareness of 
                 There is no 
                 An informal 
                 There is a 
                 A specific party 
                 The software 
                 The new software is 
               
               
                   
                 Development 
                 software 
                 process in 
                 procedure 
                 documented 
                 is responsible 
                 update policy is 
                 put in a test 
               
               
                   
                 and Support 
                 upgrade to 
                 place to 
                 exists to 
                 standard 
                 for defining and 
                 regularly reviewed 
                 environment to check 
               
               
                   
                 Processes 
                 enhance the 
                 monitor 
                 monitor 
                 available to 
                 maintaining the 
                 to ensure that it 
                 for anomalies with 
               
               
                   
                   
                 security level 
                 security risk 
                 vendor web 
                 employees 
                 software update 
                 conforms to the 
                 security policies 
               
               
                   
                   
                   
                 posed by 
                 sites to obtain 
                 describing the 
                 guidelines. An 
                 changing needs of 
                 before 
               
               
                   
                   
                   
                 software 
                 software 
                 procedures to 
                 archive is kept 
                 the business. 
                 implementation 
               
               
                   
                   
                   
                 installed on 
                 updates. This 
                 follow to ensure 
                 of all software 
                 Periodic audits are 
               
               
                   
                   
                   
                 machines. 
                 task is 
                 that all software 
                 upgrades. 
                 performed of 
               
               
                   
                   
                   
                 Software 
                 performed on 
                 installed on 
                 Change control 
                 software upgrades 
               
               
                   
                   
                   
                 upgrade 
                 an ad-hoc 
                 their machines 
                 procedures and 
                 to ensure 
               
               
                   
                   
                   
                 does not 
                 basis. 
                 is of the latest 
                 contractual 
                 compliance. 
               
               
                   
                   
                   
                 take into 
                 Security issues 
                 version. 
                 agreements exist 
                 Exceptions are 
               
               
                   
                   
                   
                 account the 
                 defined by the 
                 All security 
                 to escalate 
                 noted, documented 
               
               
                   
                   
                   
                 security of 
                 vendors are 
                 issues with the 
                 security issues to 
                 and corrective 
               
               
                   
                   
                   
                 the new 
                 only 
                 new release 
                 appropriate 
                 action is taken if 
               
               
                   
                   
                   
                 releases 
                 considered. 
                 specific to 
                 levels and 
                 necessary. 
               
               
                   
                   
                   
                   
                   
                 organizational 
                 remedy them. 
               
               
                   
                   
                   
                   
                   
                 system platform 
               
               
                   
                   
                   
                   
                   
                 are identified 
               
               
                   
                   
                   
                   
                   
                 and confirmed 
               
               
                   
                   
                   
                   
                   
                 with the 
               
               
                   
                   
                   
                   
                   
                 vendor. 
               
               
                 XI.1 
                 Aspects of 
                 Contents of 
                 No plan. 
                 There is some 
                 There is a 
                 Employees are 
                 Includes process 
                 Risk analysis of critical 
               
               
                   
                 Business 
                 Business 
                   
                 knowledge of 
                 written and 
                 trained, and 
                 for improvement 
                 business processes. 
               
               
                   
                 Continuity 
                 Continuity 
                   
                 what to do in 
                 properly 
                 training is 
                 after each 
                 Identifies events that 
               
               
                   
                 Management 
                 Process 
                   
                 case of disaster 
                 distributed plan. 
                 periodically 
                 invocation. 
                 can cause interruptions 
               
               
                   
                   
                 Procedures and 
                   
                 (e.g., based on 
                 Process 
                 refreshed. 
                   
                 to business processes, 
               
               
                   
                   
                 Schedules 
                   
                 training or on 
                 includes: 
                 Plan includes 
                   
                 and includes assessment 
               
               
                   
                   
                 Included in the 
                   
                 prior 
                 Fallback 
                 alternate 
                   
                 of the impact of those 
               
               
                   
                   
                 Process 
                   
                 experience) 
                 procedures 
                 communication 
                   
                 interruptions. 
               
               
                   
                   
                   
                   
                 but no 
                 Resumption 
                 methods if 
               
               
                   
                   
                   
                   
                 documented 
                 procedures 
                 communication 
               
               
                   
                   
                   
                   
                 process. 
                 Maintenance 
                 is severely 
               
               
                   
                   
                   
                   
                   
                 schedules 
                 affected. 
               
               
                   
                   
                   
                   
                   
                   
                 Process also 
               
               
                   
                   
                   
                   
                   
                   
                 includes: 
               
               
                   
                   
                   
                   
                   
                   
                 Assignment of 
               
               
                   
                   
                   
                   
                   
                   
                 responsibilities 
               
               
                   
                   
                   
                   
                   
                   
                 Conditions for 
               
               
                   
                   
                   
                   
                   
                   
                 activation 
               
               
                   
                   
                 Development of 
                 Plan does 
                 A set of 
                 There is a 
                 The 
                 The process is 
                 Business continuity 
               
               
                   
                   
                 Business 
                 not exist. 
                 measures can 
                 written business 
                 management 
                 reviewed in case 
                 process covers events 
               
               
                   
                   
                 Continuity 
                 Some 
                 be applied in 
                 continuity 
                 chain 
                 of change in 
                 that are specific to the 
               
               
                   
                   
                 Process 
                 awareness 
                 case of a 
                 process that 
                 responsible for 
                 system, staff, 
                 local environment (i.e., 
               
               
                   
                   
                 Testing of 
                 of measures 
                 business 
                 includes risks, 
                 executing the 
                 disaster recovery 
                 flood, power outage, 
               
               
                   
                   
                 Business 
                 that can be 
                 interruption. 
                 events, roles 
                 business 
                 contractor or 
                 political unrest, fire, 
               
               
                   
                   
                 Continuity 
                 taken in 
                 They do not 
                 and 
                 continuity 
                 contract, 
                 hurricane, earthquakes, 
               
               
                   
                   
                 Process 
                 case of a 
                 constitute 
                 responsibilities, 
                 process is 
                 business, 
                 etc.) and business needs 
               
               
                   
                   
                 Review and 
                 business 
                 formal, 
                 technical 
                 define, and all 
                 application, 
                 (i.e., credit card center 
               
               
                   
                   
                 Update of 
                 interruption. 
                 defined, 
                 measures, 
                 managers and 
                 locations, or 
                 cannot be down more 
               
               
                   
                   
                 Continuity 
                 Actions 
                 published, or 
                 reporting, and 
                 staff know what 
                 legislation. 
                 than a few minutes) 
               
               
                   
                   
                 Process 
                 would occur 
                 managed plan. 
                 communication. 
                 the chain is. 
                 Post-mortem 
               
               
                   
                   
                 Reasons that 
                 in an ad hoc 
                   
                 The plan has 
                 Testing occurs at 
                 reviews after 
               
               
                   
                   
                 Cause Review 
                 manner. 
                   
                 been tested at 
                 least annually 
                 execution with 
               
               
                   
                   
                 of the Plan 
                   
                   
                 least once. 
                 and maintains 
                 documented 
               
               
                   
                   
                   
                   
                   
                   
                 the business 
                 improvement 
               
               
                   
                   
                   
                   
                   
                   
                 continuity 
                 actions. 
               
               
                   
                   
                   
                   
                   
                   
                 process. 
               
               
                 XII.1 
                 Compliance 
                 Restrictions in 
                 No 
                 Ad hoc 
                 Systematic 
                 Clear 
                 Periodic review 
                 Copyright policy 
               
               
                   
                 with Legal 
                 Place on the 
                 restrictions 
                 restriction on 
                 restrictions, 
                 responsibility to 
                 of the policy for 
                 Acquisition procedures 
               
               
                   
                 Requirements 
                 Use of 
                 in place. 
                 some 
                 documented, 
                 enforce the 
                 continuing 
                 Copyright awareness 
               
               
                   
                   
                 Materials for 
                   
                 documents 
                 based on the 
                 restrictions. 
                 improvement. 
                 information 
               
               
                   
                   
                 Which There 
                   
                 only. 
                 information 
                 Training is 
                 Periodic review 
                 Maintenance of licenses 
               
               
                   
                   
                 May Be 
                   
                   
                 classification 
                 provided. 
                 of the 
                 Check on software 
               
               
                   
                   
                 Intellectual 
                   
                   
                   
                 Employees are 
                 restrictions to 
                 held/used 
               
               
                   
                   
                 Property Rights 
                   
                   
                   
                 aware. 
                 make sure 
                 Policy on software 
               
               
                   
                   
                   
                   
                   
                   
                   
                 they&#39;re 
                 disposal 
               
               
                   
                   
                   
                   
                   
                   
                   
                 appropriate. 
                 Compliance with 
               
               
                   
                   
                   
                   
                   
                   
                   
                   
                 licenses 
               
               
                   
                   
                 Safeguards 
                 No 
                 Some 
                 Clear 
                 Safeguards in 
                 Periodic review 
                 Personnel information 
               
               
                   
                   
                 against loss, 
                 safeguards 
                 organizational 
                 responsibilities 
                 place covering 
                 of systems in 
                 Copyright information 
               
               
                   
                   
                 destruction or 
                 employed. 
                 data backed up 
                 to ensure that 
                 all 
                 place and 
                 Company confidential 
               
               
                   
                   
                 falsification of 
                 No defined 
                 and secured. 
                 organization 
                 organizational 
                 security of 
                 information 
               
               
                   
                   
                 organizational 
                 hierarchy as 
                 Backups may 
                 records are not 
                 records. 
                 systems that deal 
                 Public web sites 
               
               
                   
                   
                 records 
                 to whom 
                 be kept onsite. 
                 compromised. 
                 Training 
                 with 
               
               
                   
                   
                   
                 has access 
                 No logs kept 
                 Some user 
                 provided to 
                 organizational 
               
               
                   
                   
                   
                 to what 
                 of user 
                 activity is 
                 educate users. 
                 records. Each 
               
               
                   
                   
                   
                 information. 
                 activity. 
                 logged. 
                 Management 
                 incident is 
               
               
                   
                   
                   
                   
                   
                 Organizational 
                 responsibly to 
                 subject to a post 
               
               
                   
                   
                   
                   
                   
                 data is kept 
                 ensure that 
                 mortem 
               
               
                   
                   
                   
                   
                   
                 securely. 
                 records are kept 
                 procedure that 
               
               
                   
                   
                   
                   
                   
                 Documents are 
                 accurate and 
                 includes a 
               
               
                   
                   
                   
                   
                   
                 publicly 
                 secure. Access 
                 review of 
               
               
                   
                   
                   
                   
                   
                 available that 
                 rights and 
                 whether 
               
               
                   
                   
                   
                   
                   
                 describe the 
                 privileges in 
                 applicable 
               
               
                   
                   
                   
                   
                   
                 policy and 
                 place to restrict 
                 policies were 
               
               
                   
                   
                   
                   
                   
                 procedures that 
                 access to certain 
                 correctly 
               
               
                   
                   
                   
                   
                   
                 employees 
                 organizational 
                 communicated. 
               
               
                   
                   
                   
                   
                   
                 should follow 
                 records. Web 
                 Users are taught 
               
               
                   
                   
                   
                   
                   
                 to maintain 
                 sites protected 
                 the incident 
               
               
                   
                   
                   
                   
                   
                 integrity and 
                 from 
                 reporting 
               
               
                   
                   
                   
                   
                   
                 safety of 
                 defacement. 
                 procedures. Full 
               
               
                   
                   
                   
                   
                   
                 organizational 
                 Critical files 
                 audit logs 
               
               
                   
                   
                   
                   
                   
                 records. 
                 identified and 
                 maintained with 
               
               
                   
                   
                   
                   
                   
                   
                 protected against 
                 system 
               
               
                   
                   
                   
                   
                   
                   
                 falsification by 
                 start/finish 
               
               
                   
                   
                   
                   
                   
                   
                 CRC checks, 
                 times, system 
               
               
                   
                   
                   
                   
                   
                   
                 etc. 
                 errors and 
               
               
                   
                   
                   
                   
                   
                   
                   
                 corrective action 
               
               
                   
                   
                   
                   
                   
                   
                   
                 and name of 
               
               
                   
                   
                   
                   
                   
                   
                   
                 person making 
               
               
                   
                   
                   
                   
                   
                   
                   
                 alterations to the 
               
               
                   
                   
                   
                   
                   
                   
                   
                 information. 
               
               
                   
                   
                 Compliance 
                 Knowledge 
                 Data 
                 Legislation is 
                 Processes and 
                 There is a 
               
               
                   
                   
                 with data 
                 of 
                 protection 
                 applied and 
                 procedures are 
                 regular process 
               
               
                   
                   
                 protection 
                 legislation 
                 legislation is 
                 Data protection 
                 put in to place 
                 in place to 
               
               
                   
                   
                 legislation 
                 is limited to 
                 discussed with 
                 legislation is 
                 for monitoring 
                 review changes 
               
               
                   
                   
                   
                 specific 
                 employees and 
                 made available 
                 to ensure that the 
                 in legislation, or 
               
               
                   
                   
                   
                 people or 
                 contract or 
                 to employees in 
                 company is 
                 new needs of the 
               
               
                   
                   
                   
                 departments 
                 temporary 
                 a centralized 
                 continually 
                 business. 
               
               
                   
                   
                   
                 (HR, Legal, 
                 personnel 
                 location. 
                 compliant. The 
                 Training is 
               
               
                   
                   
                   
                 etc.) and is 
                 upon hiring 
                 Impact of 
                 responsibility to 
                 provided to 
               
               
                   
                   
                   
                 not 
                 into specific 
                 legislation and 
                 do so is clearly 
                 users to ensure 
               
               
                   
                   
                   
                 documented. 
                 departments. 
                 concerned data 
                 assigned. 
                 the continued 
               
               
                   
                   
                   
                   
                   
                 has been 
                   
                 compliance with 
               
               
                   
                   
                   
                   
                   
                 written up and 
                   
                 legislation. The 
               
               
                   
                   
                   
                   
                   
                 made available 
                   
                 process and 
               
               
                   
                   
                   
                   
                   
                 to employees. 
                   
                 responsibility to 
               
               
                   
                   
                   
                   
                   
                 All affected 
                   
                 receive, 
               
               
                   
                   
                   
                   
                   
                 processes 
                   
                 investigate and 
               
               
                   
                   
                   
                   
                   
                 include 
                   
                 correct any 
               
               
                   
                   
                   
                   
                   
                 appropriate 
                   
                 reported 
               
               
                   
                   
                   
                   
                   
                 protection 
                   
                 exception is 
               
               
                   
                   
                   
                   
                   
                 steps. 
                   
                 defined. 
               
               
                   
                   
                 Compliance of 
                 No 
                 Standards and 
                 Standards and 
                 A clearly 
                 There is a regular 
                 Intellectual Property 
               
               
                   
                   
                 information 
                 published 
                 codes of 
                 codes of 
                 designated 
                 process in place to 
                 Rights 
               
               
                   
                   
                 systems with 
                 codes of 
                 practice are 
                 practice are 
                 person or body 
                 review changes in 
                 Copyright 
               
               
                   
                   
                 published 
                 practice and 
                 generally 
                 defined and 
                 has 
                 published standards 
                 Data Protection Act 
               
               
                   
                   
                 standards or 
                 no 
                 understood but 
                 published 
                 responsibility for 
                 or codes of 
               
               
                   
                   
                 codes of 
                 awareness 
                 are applied 
                 internally and 
                 the reviewing, 
                 practice. Findings 
               
               
                   
                   
                 practice 
                   
                 inconsistently 
                 are made 
                 maintaining, and 
                 of non-compliance 
               
               
                   
                   
                   
                   
                 through the 
                 available to 
                 training users on 
                 result in corrective 
               
               
                   
                   
                   
                   
                 organization. 
                 employees in a 
                 the published 
                 action. 
               
               
                   
                   
                   
                   
                   
                 centralized 
                 standards or 
               
               
                   
                   
                   
                   
                   
                 location. 
                 codes of 
               
               
                   
                   
                   
                   
                   
                   
                 practice. 
               
               
                 XII.2 
                 Reviews of 
                 Documentation 
                 No 
                 Some 
                 Documents are 
                 Responsibilities 
                 Documents are 
                 Laws on protection 
               
               
                   
                 Security Policy 
                 of regulatory 
                 documentation 
                 documentation 
                 made publicly 
                 are assigned to 
                 created as soon as 
                 and/or correction of 
               
               
                   
                 and Technical 
                 and contractual 
                 exists. 
                 exists although 
                 available on the 
                 individuals to 
                 there is a change in 
                 personal information 
               
               
                   
                 Compliance 
                 requirements 
                   
                 it does not 
                 corporate web 
                 produce 
                 the contractual or 
                 (employees and/or 
               
               
                   
                   
                 for each 
                   
                 cover all 
                 site or on a 
                 documents as 
                 regulatory 
                 clients, suppliers, 
               
               
                   
                   
                 information 
                   
                 details of 
                 public notice 
                 soon as a new 
                 requirements of the 
                 etc.) 
               
               
                   
                   
                 system 
                   
                 regulatory/ 
                 board. Full 
                 system is 
                 project. 
                 Procedures for 
               
               
                   
                   
                   
                   
                 contractual 
                 documentation 
                 sourced. 
                 Documentation is 
                 disclosure to proper 
               
               
                   
                   
                   
                   
                 requirements 
                 exists for 
                 Templates exist 
                 available to 
                 authorities. 
               
               
                   
                   
                   
                   
                 for each IS. 
                 contractual and 
                 for the creation 
                 personnel with 
                 ISO 9000 
               
               
                   
                   
                   
                   
                 There is no 
                 regulatory 
                 of documents 
                 correct clearance. 
                 requirements 
               
               
                   
                   
                   
                   
                 standard 
                 requirements 
                 and there is a 
                 Periodic inventory 
                 Regulatory agencies 
               
               
                   
                   
                   
                   
                 document 
                 for all 
                 central 
                 of information 
                 (e.g., FDA or FCC in 
               
               
                   
                   
                   
                   
                 template used, 
                 information 
                 repository where 
                 systems includes 
                 the United States) 
               
               
                   
                   
                   
                   
                 documents are 
                 systems in the 
                 they are stored. 
                 checks that 
               
               
                   
                   
                   
                   
                 created as and 
                 organization. 
                 The templates 
                 compliance 
               
               
                   
                   
                   
                   
                 when required 
                   
                 have designated 
                 requirements exist. 
               
               
                   
                   
                   
                   
                 by individual 
                   
                 owners. 
                 Exceptions trigger 
               
               
                   
                   
                   
                   
                 employees. 
                   
                   
                 a well-defined 
               
               
                   
                   
                   
                   
                 There is no 
                   
                   
                 process to review 
               
               
                   
                   
                   
                   
                 central data 
                   
                   
                 procedures in order 
               
               
                   
                   
                   
                   
                 store for the 
                   
                   
                 to eliminate this 
               
               
                   
                   
                   
                   
                 documents 
                   
                   
                 risk. 
               
               
                   
                   
                   
                   
                 (need to ask 
               
               
                   
                   
                   
                   
                 people who 
               
               
                   
                   
                   
                   
                 know). 
               
               
                 XII.3 
                 System Audit 
                 Control Against 
                 No controls 
                 Terms of use 
                 Terms of use of 
                 The 
                 Periodic reviews of 
               
               
                   
                 Considerations 
                 Computer 
                 or 
                 of computer 
                 organizations 
                 responsibility of 
                 who is authorized 
               
               
                   
                   
                 Misuse 
                 safeguards 
                 equipment are 
                 computer 
                 managers is 
                 to do what. 
               
               
                   
                   
                 Safeguard of 
                 in place 
                 discussed with 
                 equipment are 
                 defined. Tools 
                 Information 
               
               
                   
                   
                 Audit Tools to 
                   
                 employees and 
                 available from a 
                 employed to 
                 gathered from 
               
               
                   
                   
                 Prevent Misuse 
                   
                 contract or 
                 centralized 
                 monitor usage of 
                 monitoring tools is 
               
               
                   
                   
                   
                   
                 temporary 
                 location 
                 computer 
                 used to make 
               
               
                   
                   
                   
                   
                 personnel 
                 (Intranet site, 
                 equipment. 
                 decisions for future 
               
               
                   
                   
                   
                   
                 upon hiring. 
                 office notice 
                 Staff has well 
                 policy. 
               
               
                   
                   
                   
                   
                   
                 boards, etc) 
                 defined roles 
                 There is an incident 
               
               
                   
                   
                   
                   
                   
                   
                 and access rights 
                 review procedure. 
               
               
                   
                   
                   
                   
                   
                   
                 to computer file 
                 Periodic “white 
               
               
                   
                   
                   
                   
                   
                   
                 systems. 
                 hat” intrusion 
               
               
                   
                   
                   
                   
                   
                   
                 Personnel are 
                 attempts are made 
               
               
                   
                   
                   
                   
                   
                   
                 made aware that 
                 and followed by 
               
               
                   
                   
                   
                   
                   
                   
                 their computer 
                 corrective actions. 
               
               
                   
                   
                   
                   
                   
                   
                 related activities 
               
               
                   
                   
                   
                   
                   
                   
                 are being 
               
               
                   
                   
                   
                   
                   
                   
                 monitored, and 
               
               
                   
                   
                   
                   
                   
                   
                 to what extent. 
               
               
                   
                   
                 Review/Audit 
                 No process 
                 Occasionally 
                 Reviewed at 
                 A clearly 
                 There is a defined 
               
               
                   
                   
                 of information 
                 is in place 
                 reviewed or 
                 intervals, but no 
                 designated 
                 mechanism to 
               
               
                   
                   
                 systems to 
                   
                 audited if 
                 clear 
                 person or body 
                 review and upgrade 
               
               
                   
                   
                 ensure they are 
                   
                 senior 
                 management 
                 has 
                 the policy after 
               
               
                   
                   
                 in compliance 
                   
                 management, 
                 responsibility to 
                 responsibility for 
                 every security 
               
               
                   
                   
                 with security 
                   
                 auditors, etc., 
                 trigger reviews 
                 the process, and 
                 incident (Is 
               
               
                   
                   
                 policies and 
                   
                 ask 
                 of exploit 
                 reviews it 
                 anything missing 
               
               
                   
                   
                 standards 
                   
                   
                 results 
                 regularly. 
                 from the policy that 
               
               
                   
                   
                   
                   
                   
                   
                   
                 could have 
               
               
                   
                   
                   
                   
                   
                   
                   
                 prevented the 
               
               
                   
                   
                   
                   
                   
                   
                   
                 problem?) 
               
               
                   
                   
                 Coverage of 
                 No 
                 Few 
                 Clear 
                 Audit tools are 
                 Safeguards in place 
               
               
                   
                   
                 System Regime 
                 coverage 
                 safeguards in 
                 responsibilities 
                 only available 
                 covering all audit 
               
               
                   
                   
                 (event logging) 
                 exists. 
                 place. Audit 
                 to ensure that 
                 for use by key 
                 tools. Periodic 
               
               
                   
                   
                   
                   
                 tools are not 
                 audit tools are 
                 personnel. 
                 review of systems 
               
               
                   
                   
                   
                   
                 managed 
                 not misused. 
                 Access rights 
                 in place and 
               
               
                   
                   
                   
                   
                 securely and 
                 Training 
                 and privileges 
                 security of systems 
               
               
                   
                   
                   
                   
                 user access is 
                 provided to 
                 are enforced to 
                 that audit systems. 
               
               
                   
                   
                   
                   
                 not monitored. 
                 educate users. 
                 maintain 
                 Users are educated 
               
               
                   
                   
                   
                   
                   
                   
                 security. 
                 on the importance 
               
               
                   
                   
                   
                   
                   
                   
                   
                 of safeguarding 
               
               
                   
                   
                   
                   
                   
                   
                   
                 their audit tools. 
               
               
                   
                   
                 Compliance of 
                 No 
                 Standards and 
                 Standards and 
                 A clearly 
                 There is a regular 
                 Intellectual Property 
               
               
                   
                   
                 information 
                 published 
                 codes of 
                 codes of 
                 designated 
                 process in place to 
                 Rights 
               
               
                   
                   
                 systems with 
                 codes of 
                 practice are 
                 practice are 
                 person or body 
                 review changes in 
                 Copyright 
               
               
                   
                   
                 published 
                 practice and 
                 generally 
                 defined and 
                 has 
                 published standards 
                 Data Protection Act 
               
               
                   
                   
                 standards or 
                 no 
                 understood but 
                 published 
                 responsibility for 
                 or codes of 
               
               
                   
                   
                 codes of 
                 awareness 
                 are applied 
                 internally and 
                 the reviewing, 
                 practice. Findings 
               
               
                   
                   
                 practice 
                   
                 inconsistently 
                 are made 
                 maintaining, and 
                 of non-compliance 
               
               
                   
                   
                   
                   
                 through the 
                 available to 
                 training users on 
                 result in corrective 
               
               
                   
                   
                   
                   
                 organization. 
                 employees in a 
                 the published 
                 action. 
               
               
                   
                   
                   
                   
                   
                 centralized 
                 standards or 
               
               
                   
                   
                   
                   
                   
                 location. 
                 codes of 
               
               
                   
                   
                   
                   
                   
                   
                 practice. 
               
               
                   
               
             
          
         
       
     
     Referring to the Security Assessment Matrix shown in Table 1, to perform the assessment for a given item, the assessment entity need only perform the following steps: (i) find the item in question, first by category then by sub-category; (ii) read the descriptions under each maturity level and determine if requirements of that maturity level are met; and (iii) record the highest maturity level for that item that is met by the organization&#39;s current information security policies and practices. 
     Once the preliminary rating has been completed, it may be displayed in a graphical manner. In one embodiment of the invention, the preliminary rating is displayed using a Security Maturity Assessment Reporting Tool (SMART). SMART allows the preliminary rating to be shown at a detailed level, i.e., all 61 elements are shown, or at a summary level, i.e., only 10 broad categories are shown. Further, SMART allows the organization to compare the preliminary rating to a predefined goal, an industry average, or to a prior assessment. Additionally, the layout of the SMART report allows an organization to readily identify areas that require improvement. 
       FIG. 3  illustrates a portion of a SMART report in accordance with one or more embodiments of the invention. A first column ( 10 ) lists the broad categories. A second column ( 12 ) lists the items within each of the categories. 
     A third column ( 14 ) graphically represents the “assessed capability maturity” (ACM) ( 16 ). The third column is sub-divided into five levels (L1, L2, L3, L4, and L5) corresponding to the maturity levels listed above. For each item, the ACM is represented by shading the corresponding row up to the appropriate level. If the ACM is not at a goal ( 18 ), i.e., the level at which the organization wishes to be for the particular item, then an additional shading representing a gap ( 20 ) between the goal ( 18 ) and the ACM ( 16 ) is present. 
     For example, in  FIG. 3 , Category 2 contains four items: Item D ( 2 ), Item E ( 4 ), Item F ( 6 ), and Item G ( 8 ). Specifically, looking at Item G ( 8 ), the ACM ( 16 ) is at level 2 ( 22 ), while the goal ( 18 ) is at level 3 ( 24 ). Thus, a gap ( 20 ) is present between level 2 ( 22 ) and level 3 ( 24 ) on the row containing Item G ( 8 ). Thus, the organization can readily see that Item G ( 8 ) is below the goal ( 18 ). By contrast, the organization can also readily see that capability maturity level for Item F ( 6 ) is at the goal ( 26 ) set for this item, so there is no gap relative to Item F ( 6 ). 
     Returning back to the SMA phase, once the preliminary rating has been completed, the assessment entity reviews the preliminary rating with the organization. During the review, the preliminary rating may be revised, if necessary. Once this has been completed, a final rating is generated. 
     During the corrective action plan (CAP) phase, the CAP is generated using the final rating and the Security Assessment Matrix. The proposed actions are aimed at improving the items that have gaps and bringing the items Up to the goal. Additionally, items in the CAP may also be prioritized according to the needs and resources of the organization. During the corrective action plan execution phase, the CAP is executed. For example, if the SAM states that for a certain item to be at Level 3, “the policy is written down,” and to be at Level 4, “there is an assigned manager in charge of applying this policy,” then it follows that if an organization is assessed at Level 3 for this item, and its goal is to be at Level 4, then the CAP should include the following action: “Put a manager in charge of this policy.” 
     The monitoring phase of the SMA includes periodic SMART reports to ensure that goals are met and maintained. Further, during this phase, the assessment entity may detect change in the environment that might require additions or changes to the security practices and/or policies. Additionally, during the monitoring phase, the assessment entity may provide assistance for debriefing the organization in the event of an information security incident. In one or more embodiments of the invention, the monitoring phase is optional. 
       FIG. 4  illustrates a flowchart detailing the SMA method in accordance with another embodiment of the invention. Initially, the organization&#39;s business goals are determined (Step  112 ), as well as the associated risk in terms of information security (Step  114 ). Written documentation is then collected about the organization&#39;s existing information security policies and practices (Step  116 ). Additional information is then collected via interviews (Step  118 ). Using the information gathered in Steps  112  through  118 , the SAM rating is generated (Step  120 ). If additional information is obtained (Step  122 ), then step  120  may be repeated. If no additional information is obtained (Step  122 ), then a list of corrective actions is proposed (Step  124 ). The corrective actions are subsequently prioritized (Step  126 ) and executed (Step  128 ) to generate modified information security policies and procedures. The modified information security policies and procedures are then monitored (Step  130 ). If there is a change in the information security environment, e.g., a first organization merges with a second organization resulting in the first organization&#39;s network being integrated into the second organization&#39;s network, or if the time for a periodic review arrives (Step  132 ), then the process proceeds back to Step  116 . 
     The invention, in one or more embodiments, may have one or more of the following advantages. The SMA method is a systematic approach that includes a process, a detailed method for assessment (i.e., SAM), and a reporting tool (i.e., SMART). Further, the SMA method covers all aspects of information security and explicitly defines what each level means for each item. Further, the SMA method is action oriented. Further, each item is assessed as a capability maturity rather than pass/fail, allowing an organization to readily gauge where the organization is with respect to a particular information security item and to measure progress over time or against a goal, even if that progress is gradual. Additionally, the security assessment matrix may be used as a list of recommendations to detail how the organization may attain its information security goals. 
     Further, the SMA method is easy to apply, as each item and corresponding set of criteria for each maturity level associated with the item are clearly defined. Further, the SMA method is flexible, as it may be used for multiple purposes. For example, the SMA may be used for the purpose of establishing to a customer or regulatory authority that an organization has the required capability to perform a certain task. The SMA may also be used for the purpose of internally monitoring, over time, improvements decided by the organization&#39;s management. The SMA may also be used for the purpose of meeting a certain industry standard or reaching a goal established through analysis of the competition&#39;s security capabilities. 
     Further, the invention produces an objective rating of an organization&#39;s information security practices and policies removing the subjective element of the assessment process. 
     While the invention has been described with respect to a limited number of embodiments, those skilled in the art, having benefit of this disclosure, will appreciate that other embodiments can be devised which do not depart from the scope of the invention as disclosed herein. Accordingly, the scope of the invention should be limited only by the attached claims.