ITSAC - Module 4 Flashcards
- high-level overview or the org
- long term plan (5+ years)
- forward looking
- each level of division translates plan objectives into more specific objectives
- executive team (CEO, COO, CFO, CIO)
Strategic Planning
- methods used to achieve the strategy
- short term plan (1-2 year or less)
- includes specific goals, budget, resources
- breaks down strategil goals
- eg. project plans, resource acquisition, project budgets, project reviews
- Chief Information Security Officer (CISO) and security managers
Tactical Planning
- plan day to day running
- controlled via daily/weekly/monthly/annual
- inclued necessary tasks for all departments, communication, and reporting requirements
Operational Planning
High-level statements which define roles, responsibilities, and expectations for specific domain areas.
- general
- what to do & not to do in org
- “all company data should be protected from unauthorized access”
Policies
Specific low-level, mandatory controls that help enforce and support policies.
- how to comply to a certain policy
Standards
Recommended controls that help support standards or serve as a reference for when no applicable standard is available.
- not mandatory
- “use password manager”
Guidelines
Step-by-step instructions to accomplish policies, standards, and guidelines.
- specific
- how to change password
Procedures
- isa
management-level document, often written by the company’sCIO, detailing the company’sphilosophy on security. - general policy to a whole
1. Enterprise information security policies
– is developed by an organization to outline the guidelines that govern the use of individual technologies in that organization.
- specific
2. Issue-specific security policies (ISSP)
- focus on the information security
policies of particular systems. For example, policies for customer-facing applications, payroll systems, or data archive systems. - identtify security needed
3. Systems-specific security policies
: An Introduction to Computer Security: The NIST Handbook
SP 800-12
: Generally Accepted Principles and Practices for Securing Information Technology Systems
SP 800-14
: Guide for Developing Security Plans for Federal Information Systems
SP 800-18 Rev. 1
: Guide for Conducting Risk Assessments
SP 800-30 Rev. 1
: Guide for Applying the Risk Management Framework to Federal Information Systems: ASecurity Life Cycle Approach
SP 800-37 Rev. 1
: Managing Information Security Risk: Organization, Mission, and Information System View
SP 800-39
: Building an Information Technology Security Awareness and Training Program
SP 800-50
: Performance Measurement Guide for Information Security
SP 800-55 Rev. 1
: Information Security Handbook: A Guide for Managers
SP 800-100
