English: More specifically, determine if policies, practices and procedures exist for the following areas:\par \pard{\pard{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Organizing and Administering ITS {\pard{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{organizing}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{responsibilities and accountabilities}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{planning including contingency planning}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{security risk management}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{certification and accreditation}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{maintenance}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{managing cryptographic materiel}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{monitoring and reviewing {\pard{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Personnel Security}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Physical Security}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Hardware Security}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Software Security}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Communications Security and}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Operations Security.}\par }}}\par }}}\par }}\pard \ql \sb100\sa100 {1.4.2 Determine whether departmental policies, practices and procedures for planning, implementing and maintaining information management and IT reflect current ITS policies, practices and procedures.
French: Voir à ce que les politiques comprennent, à tout le moins, les exigences du chapitre 2-3 de la politique sur la sécurité.}\par \pard\ql Plus précisément, déterminer si des politiques, méthodes et procédures existent dans les domaines suivants :\par \pard{\pard{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{organisation et administration de la STI; {\pard{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{organisation,}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{responsabilités et responsabilisations,}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{planification incluant la planification des mesures d'urgence,}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{gestion des risques pour la sécurité,}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{certification et accréditation,}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{entretien,}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{gestion du matériel cryptographique, et}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{surveillance et examen. {\pard{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{sécurité du personnel;}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{sécurité matérielle;}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{sécurité du matériel;}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{sécurité des logiciels;}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{sécurité des communications; et}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{sécurité de l'exploitation.}\par }}}\par }}}\par }}\pard \ql \sb100\sa100 {1.4.2 Déterminer si les politiques, méthodes et procédures de planification, de mise en oeuvre et de maintien de la gestion de l'information et des TI du ministère reflètent les politiques, méthodes et procédures actuelles de la STI.