Review any documentation that indicates the security program has been reviewed. Assess whether the document clearly indicates the date it was last updated. Review security standards and procedures and evidence of management approval. A security management structure is established. A security management structure has been defined and documented.
Security management has adequate independence.
A security manager has been appointed. The security manager has overall responsibility for consistent direction of and control over security. The security manager reports to senior management. Management has established an optimal coordination, communication and liaison structure between IT and the security manager. Review job descriptions for security management personnel.