5.1 Policies, plans and procedures related to organizational security

Question 1

BPA

Answer 1

Business partners agreement

Question 2

SLA

Answer 2

(service level agreement) Operating procedures and standards for a service contract.

Question 3

ISA

Answer 3

(interconnection security agreement) A business agreement that focuses on ensuring security between organizations in a partnership. Any federal agency interconnecting its IT system to a third party must create an ISA to govern the relationship. An ISA sets out a security risk awareness process and commits the agency and supplier to implementing security controls.

Question 4

MOU/MOA

Answer 4

(Memorandum of Understanding) Usually a preliminary or exploratory agreement to express an intent to work together.

Question 5

Job rotation

Answer 5

Means that no one person is permitted to remain in the same job for an extended period.

Question 6

Separation of duties

Answer 6

A means of establishing checks and balances against the possibility that critical systems or procedures can be compromised by insider threats.

Question 7

Data owner

Answer 7

A senior (executive) role with ultimate responsibility for maintaining the confidentiality, integrity, and availability of the information asset.

Question 8

System administrator

Answer 8

The day-to-day sysadmin role requires technical understanding of access controls and privilege management systems.

Question 9

System owner

Answer 9

This role is responsible for designing and planning computer, network, and database systems. The role requires expert knowledge of IT security and network design.

Question 10

Privileged user

Answer 10

Employees with access to privileged data should be given extra training on data management and PII plus any relevant regulatory or compliance frameworks.

Question 11

Executive user

Answer 11

Good security awareness is essential as these users are likely to be specifically targeted (whale phishing and spear phishing).

Question 12

Continuing education

Answer 12

Ensures that the participants do not treat a single training course or certificate as a sort of final accomplishment. Skills and knowledge must be continually updated to cope with changes to technology and regulatory practices.

Question 13

Adverse actions

Answer 13

Means that in disciplining or firing an employee, the employer is discriminating against them in some way.