My Blog

Category: Information Systems

  • [Solved] V

    ✓ Verified Academic Solution Available

    Executive Solution Overview

    See attached – 2 years ago – 3.5 **files (2)** – ## V.docx – ## UnitV.pdf **## V.docx** Should organizations have data or information owners? Please explain why or why not. Consider the costs, roles, and responsibilities for the data and information. Course Textbook(s) Santos, O. (2019). Developing …

    Instant Solution Download

    $6.99

    Immediate access to the full model answer, formatted citations, and rubric breakdown.

    Need a Fresh Custom Paper?

    Have this question answered from scratch according to your specific instructions and deadline.

    Order on TutorsGallery →

    Assignment Prompt & Instructions

    See attached

    – 2 years ago
    – 3.5

    **files (2)**

    – ## V.docx

    – ## UnitV.pdf

    **## V.docx**

    Should organizations have data or information owners? Please explain why or why not. Consider the costs, roles, and responsibilities for the data and information.

    Course Textbook(s)

    Santos, O. (2019). Developing cybersecurity programs and policies (3rd ed.). Pearson. https://online.vitalsource.com/#/books/9780134858548

    **## UnitV.pdf**

    SEC 4303, IS Security Policy Analysis 1

    Course Learning Outcomes for Unit V

    Upon completion of this unit, students should be able to:

    4. Analyze a security policy for its completeness.
    4.1 Determine information classifications for security policies.
    4.2 Identify the information owners of an organization.

    5. Show a familiarity with a wide range of substantive issues in IS security policy creation.

    5.1 Indicate the different types of information assets.

    Reading Assignment

    Chapter 5: Asset Management and Data Loss Prevention

    Unit Lesson

    A major benefit of creating a policy is to protect the assets and prevention of types of data loss. If we fail to
    create these policies, then we increase our chances of the data loss or potential theft of the assets. The first
    phase of protecting the assets is to determine the values and importance to the organization. For example, if
    we have Cisco equipment that costs $250,000, then policies should be in place to protect this hardware. On
    the other hand, you may have a router or specialty equipment with less value; this does not mean it should
    not have a policy assigned to the equipment, but it can be grouped into a classification for general use and
    best practices. We would not want to spend 20 hours working on an asset policy for assets with a value of
    $5,000. At some point, there are diminishing returns, so proper planning and good decision-making are
    needed when examining the need for asset management policies. We also have to take into consideration the
    need for further updates as we make the decisions.

    Classifications

    The identification and classification of the information assets and systems are essential to protect against
    confidentiality, integrity, and availability (Santos, 2019). The National Institute for Standards and Technology
    (NIST) (2018) uniquely identifies assets (components) based on known identifiers and/or known information
    about the assets. Therefore, we can group or combine the assets for common policy practices. Asset
    management provides a framework or process to ensure that assets are adequately protected. An example of
    an asset management methodology is tracking and inventorying IT hardware and software. Additionally, it is
    recommended that organizations identify if there is an asset management system that needs to be included in
    the policy. Some of the private classifications are listed below.

    Protected: Data that is protected by law, regulation, memorandum of agreement, contractual obligation, or
    management discretion are considered protected (Santos, 2019). It is in this situation that organizations need
    to protect the nonpublic information from external personnel, employees without the proper access rights, and
    criminals. If you work for a financial institution, the entity will have its customer’s social security number,
    address, account numbers, and credit scores. This information needs to be protected because it is classified.

    Confidential: Confidential information should only be accessible and viewed by those individuals that an
    organization has deemed trustworthy and within the appropriate level. Santos (2019) provided examples of
    business strategies, financial positions, employee records, upcoming sales or advertising campaigns,
    laboratory research, and product schematics as confidential artifacts. It is obvious for this classification an
    organization may want its chief financial officer (CFO) to have access to the financial records and balance
    sheets, but not necessarily the laboratory research. Therefore, the classification of confidential should not

    UNIT V STUDY GUIDE
    Protecting Organizational Assets and Data

    SEC 4303, IS Security Policy Analysis 2

    UNIT x STUDY GUIDE
    Title

    only apply to the most trustworthy personnel, but should also be appropriate to the department. In the case of
    the laboratory research, a CFO may not understand the full importance of the information he or she has, so
    he or she could accidently discard the information in a trash bin. However, a CFO would certainly protect the
    end-of-year financial reports because he or she understands the importance of protecting the information.

    Internal use: If the information or data are classified for internal use, then that information should only be
    distributed within the organization. We have seen information technology (IT) take a proactive role in disabling
    SharePoint site links for only internal personnel. For example, as part of Office 365 and One Drive,
    employees usually have the option to share a document or spreadsheet, but if this information is classified as
    internal use only, then the OneDrive links should be locked from sharing with anyone outside the domain or
    active directory.

    Public: Public information is certainly the less stringent classification. An organization may have marketing
    material, product brochures, or annual reports. This information is usually readily available to the public, so it
    is not detrimental if the information is sent outside the organization. However, management and possibly the
    legal department should approve any modifications or adjustments to the information.

    Organizations can review more information on the asset management standards by reviewing the ISO 55000
    standard. The ISO 55000 series is comprised of three standards. ISO 55000 is an overview of the subject of
    asset management and the standard terms and definitions, ISO 55001 is the requirements specification for an
    integrated, effective management system for asset management, and ISO 55002 provides guidance for the
    implementation of such a management system (The Woodhouse Partnership, 2018). We can use these
    standards when creating the information system (IS) security policies for asset management. Knowing what
    the organization has, where everything is, its importance, and ownership are important pieces to asset
    management.

    The following site explores a great outline for creating a policy using ISO 550001. In the article, you will find
    the importance of alignment, top management support, business objectives, purposes, and communication of
    the policy. The article states the policy should be short, consistent with the overall goals and other policies,
    provide guidance, and have common elements found with other policies. We previously discussed the
    importance of using templates or common headings to ensure everyone uses a standard and approved
    format.

    Dunn, S. (n.d.). How to write a good asset management policy – Implementing ISO 55000.

    https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-
    a-good-asset-management-policy.html

    We now understand assets are important to protect, consequently, we need to define how IS assets relate to
    the organization. Santos (2019) explains that an information asset is a definable piece of information that is
    recognized as having value. Therefore, the information residing on our databases is of value to our
    operations, so it is considered an information asset. If you become an IT manager, then your department
    should develop an asset strategy to include information assets, software assets, and information technology
    equipment.

    Consider the information the employees have when it comes to procedures or intellectual property. Santos
    (2019) outlines data warehouses, intellectual property, and operation procedures as information assets. An
    asset management strategy is a broad level plan set by senior management as a guide to how an
    organization intends to protect assets, ranging from legislative mandates (and their enforcement) to policies to
    technical security controls. Information and physical assets must be protected throughout their life cycle, from
    creation or purchase through final disposal or long-term storage. As we have learned, with the importance of
    identifying the information assets, there is also a need to assign accountability to manage these assets.

    Are employees considered an asset in an organization’s asset management strategy?

    [https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html](https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html)

    [https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html](https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html)

    SEC 4303, IS Security Policy Analysis 3

    UNIT x STUDY GUIDE
    Title

    The key concept is to determine the ownership of the information assets. Some of the most important
    elements to consider when developing an asset management strategy are:

    • inventory assets,
    • definition of responsibility and ownership,
    • importance,
    • establishment of acceptable use policies for information and assets, and
    • protection.

    A best practice is for the data owner to also function as a secondary champion to embrace the
    confidentiality, integrity, and availability (CIA) model (Santos, 2019). We want the staff employees to be
    users of the information, but we need data owners, such as supervisors or management, to ensure the
    policies are being enforced to protect the assets.

    Once the data owners are identified, then the information security owner needs to work with these individuals
    to review existing policies or create new ones. The information security officer (ISO) should provide direction
    and guidance as to the appropriate controls and ensure that controls are applied consistently throughout the
    organization (Santos, 2019). It is certainly an ideal situation to have a designated employee with the role of
    the ISO, but this is not always the case in most organizations because of resources or budget limitations.
    Many organizations have ineffective or insufficient policies simply because they have not been updated.
    Additionally, there needs to be clear communication between the users, data owners, and information security
    officer regarding these policies.

    Summary

    As found in Chapter 5, information can be classified by confidentiality, integrity, and availability factors.
    Santos (2019) also discussed how national security applies classification to top secret, secret, confidential,
    unclassified, and sensitive/but classified information. In business, we can review the sensitivity of the data
    and then assign access controls depending on the group or level of the employee. For example, an accounts
    payable employee should have access to the accounts payable forms or pages, but he or she should not
    have access to the vendors form because this employee could create a vendor for a family member and then

    Data owner responsibilities
    (Adapted from Santos, 2019)

    What would be the value and impact of creating a policy to address the information
    assets, but not assigning teams or groups with a responsibility for the protections?

    SEC 4303, IS Security Policy Analysis 4

    UNIT x STUDY GUIDE
    Title

    send payments. However, the chief financial officer (CFO) should have access to all forms and ensure the
    payables policies are followed. Therefore, it is extremely important for IT and human resources (HR) to
    constantly work together to ensure the employees have access to the appropriate information depending on
    their roles within the organization. A large organization may have well-defined processes for this alignment,
    while most small- or medium-size businesses may be set up as verbal rather than formal policies.

    References

    The Woodhouse Partnership. (2018). Latest news in standards for asset management. ISO 55000 Standards

    for Asset Management. https://www.assetmanagementstandards.com/

    National Institute of Standards and Technology. (2018). Computer security resource center: Asset

    identification. https://csrc.nist.gov/glossary/term/Asset-Identification

    Santos, O. (2019). Developing cybersecurity programs and policies (3rd ed.). Upper Saddle River, NJ:

    Pearson.

    – Course Learning Outcomes for Unit V
    – Reading Assignment
    – Unit Lesson

    **## UnitV.pdf**

    SEC 4303, IS Security Policy Analysis 1

    Course Learning Outcomes for Unit V

    Upon completion of this unit, students should be able to:

    4. Analyze a security policy for its completeness.
    4.1 Determine information classifications for security policies.
    4.2 Identify the information owners of an organization.

    5. Show a familiarity with a wide range of substantive issues in IS security policy creation.

    5.1 Indicate the different types of information assets.

    Reading Assignment

    Chapter 5: Asset Management and Data Loss Prevention

    Unit Lesson

    A major benefit of creating a policy is to protect the assets and prevention of types of data loss. If we fail to
    create these policies, then we increase our chances of the data loss or potential theft of the assets. The first
    phase of protecting the assets is to determine the values and importance to the organization. For example, if
    we have Cisco equipment that costs $250,000, then policies should be in place to protect this hardware. On
    the other hand, you may have a router or specialty equipment with less value; this does not mean it should
    not have a policy assigned to the equipment, but it can be grouped into a classification for general use and
    best practices. We would not want to spend 20 hours working on an asset policy for assets with a value of
    $5,000. At some point, there are diminishing returns, so proper planning and good decision-making are
    needed when examining the need for asset management policies. We also have to take into consideration the
    need for further updates as we make the decisions.

    Classifications

    The identification and classification of the information assets and systems are essential to protect against
    confidentiality, integrity, and availability (Santos, 2019). The National Institute for Standards and Technology
    (NIST) (2018) uniquely identifies assets (components) based on known identifiers and/or known information
    about the assets. Therefore, we can group or combine the assets for common policy practices. Asset
    management provides a framework or process to ensure that assets are adequately protected. An example of
    an asset management methodology is tracking and inventorying IT hardware and software. Additionally, it is
    recommended that organizations identify if there is an asset management system that needs to be included in
    the policy. Some of the private classifications are listed below.

    Protected: Data that is protected by law, regulation, memorandum of agreement, contractual obligation, or
    management discretion are considered protected (Santos, 2019). It is in this situation that organizations need
    to protect the nonpublic information from external personnel, employees without the proper access rights, and
    criminals. If you work for a financial institution, the entity will have its customer’s social security number,
    address, account numbers, and credit scores. This information needs to be protected because it is classified.

    Confidential: Confidential information should only be accessible and viewed by those individuals that an
    organization has deemed trustworthy and within the appropriate level. Santos (2019) provided examples of
    business strategies, financial positions, employee records, upcoming sales or advertising campaigns,
    laboratory research, and product schematics as confidential artifacts. It is obvious for this classification an
    organization may want its chief financial officer (CFO) to have access to the financial records and balance
    sheets, but not necessarily the laboratory research. Therefore, the classification of confidential should not

    UNIT V STUDY GUIDE
    Protecting Organizational Assets and Data

    SEC 4303, IS Security Policy Analysis 2

    UNIT x STUDY GUIDE
    Title

    only apply to the most trustworthy personnel, but should also be appropriate to the department. In the case of
    the laboratory research, a CFO may not understand the full importance of the information he or she has, so
    he or she could accidently discard the information in a trash bin. However, a CFO would certainly protect the
    end-of-year financial reports because he or she understands the importance of protecting the information.

    Internal use: If the information or data are classified for internal use, then that information should only be
    distributed within the organization. We have seen information technology (IT) take a proactive role in disabling
    SharePoint site links for only internal personnel. For example, as part of Office 365 and One Drive,
    employees usually have the option to share a document or spreadsheet, but if this information is classified as
    internal use only, then the OneDrive links should be locked from sharing with anyone outside the domain or
    active directory.

    Public: Public information is certainly the less stringent classification. An organization may have marketing
    material, product brochures, or annual reports. This information is usually readily available to the public, so it
    is not detrimental if the information is sent outside the organization. However, management and possibly the
    legal department should approve any modifications or adjustments to the information.

    Organizations can review more information on the asset management standards by reviewing the ISO 55000
    standard. The ISO 55000 series is comprised of three standards. ISO 55000 is an overview of the subject of
    asset management and the standard terms and definitions, ISO 55001 is the requirements specification for an
    integrated, effective management system for asset management, and ISO 55002 provides guidance for the
    implementation of such a management system (The Woodhouse Partnership, 2018). We can use these
    standards when creating the information system (IS) security policies for asset management. Knowing what
    the organization has, where everything is, its importance, and ownership are important pieces to asset
    management.

    The following site explores a great outline for creating a policy using ISO 550001. In the article, you will find
    the importance of alignment, top management support, business objectives, purposes, and communication of
    the policy. The article states the policy should be short, consistent with the overall goals and other policies,
    provide guidance, and have common elements found with other policies. We previously discussed the
    importance of using templates or common headings to ensure everyone uses a standard and approved
    format.

    Dunn, S. (n.d.). How to write a good asset management policy – Implementing ISO 55000.

    https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-
    a-good-asset-management-policy.html

    We now understand assets are important to protect, consequently, we need to define how IS assets relate to
    the organization. Santos (2019) explains that an information asset is a definable piece of information that is
    recognized as having value. Therefore, the information residing on our databases is of value to our
    operations, so it is considered an information asset. If you become an IT manager, then your department
    should develop an asset strategy to include information assets, software assets, and information technology
    equipment.

    Consider the information the employees have when it comes to procedures or intellectual property. Santos
    (2019) outlines data warehouses, intellectual property, and operation procedures as information assets. An
    asset management strategy is a broad level plan set by senior management as a guide to how an
    organization intends to protect assets, ranging from legislative mandates (and their enforcement) to policies to
    technical security controls. Information and physical assets must be protected throughout their life cycle, from
    creation or purchase through final disposal or long-term storage. As we have learned, with the importance of
    identifying the information assets, there is also a need to assign accountability to manage these assets.

    Are employees considered an asset in an organization’s asset management strategy?

    [https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html](https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html)

    [https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html](https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html)

    SEC 4303, IS Security Policy Analysis 3

    UNIT x STUDY GUIDE
    Title

    The key concept is to determine the ownership of the information assets. Some of the most important
    elements to consider when developing an asset management strategy are:

    • inventory assets,
    • definition of responsibility and ownership,
    • importance,
    • establishment of acceptable use policies for information and assets, and
    • protection.

    A best practice is for the data owner to also function as a secondary champion to embrace the
    confidentiality, integrity, and availability (CIA) model (Santos, 2019). We want the staff employees to be
    users of the information, but we need data owners, such as supervisors or management, to ensure the
    policies are being enforced to protect the assets.

    Once the data owners are identified, then the information security owner needs to work with these individuals
    to review existing policies or create new ones. The information security officer (ISO) should provide direction
    and guidance as to the appropriate controls and ensure that controls are applied consistently throughout the
    organization (Santos, 2019). It is certainly an ideal situation to have a designated employee with the role of
    the ISO, but this is not always the case in most organizations because of resources or budget limitations.
    Many organizations have ineffective or insufficient policies simply because they have not been updated.
    Additionally, there needs to be clear communication between the users, data owners, and information security
    officer regarding these policies.

    Summary

    As found in Chapter 5, information can be classified by confidentiality, integrity, and availability factors.
    Santos (2019) also discussed how national security applies classification to top secret, secret, confidential,
    unclassified, and sensitive/but classified information. In business, we can review the sensitivity of the data
    and then assign access controls depending on the group or level of the employee. For example, an accounts
    payable employee should have access to the accounts payable forms or pages, but he or she should not
    have access to the vendors form because this employee could create a vendor for a family member and then

    Data owner responsibilities
    (Adapted from Santos, 2019)

    What would be the value and impact of creating a policy to address the information
    assets, but not assigning teams or groups with a responsibility for the protections?

    SEC 4303, IS Security Policy Analysis 4

    UNIT x STUDY GUIDE
    Title

    send payments. However, the chief financial officer (CFO) should have access to all forms and ensure the
    payables policies are followed. Therefore, it is extremely important for IT and human resources (HR) to
    constantly work together to ensure the employees have access to the appropriate information depending on
    their roles within the organization. A large organization may have well-defined processes for this alignment,
    while most small- or medium-size businesses may be set up as verbal rather than formal policies.

    References

    The Woodhouse Partnership. (2018). Latest news in standards for asset management. ISO 55000 Standards

    for Asset Management. https://www.assetmanagementstandards.com/

    National Institute of Standards and Technology. (2018). Computer security resource center: Asset

    identification. https://csrc.nist.gov/glossary/term/Asset-Identification

    Santos, O. (2019). Developing cybersecurity programs and policies (3rd ed.). Upper Saddle River, NJ:

    Pearson.

    – Course Learning Outcomes for Unit V
    – Reading Assignment
    – Unit Lesson

    **## V.docx**

    Should organizations have data or information owners? Please explain why or why not. Consider the costs, roles, and responsibilities for the data and information.

    Course Textbook(s)

    Santos, O. (2019). Developing cybersecurity programs and policies (3rd ed.). Pearson. https://online.vitalsource.com/#/books/9780134858548

    **## UnitV.pdf**

    SEC 4303, IS Security Policy Analysis 1

    Course Learning Outcomes for Unit V

    Upon completion of this unit, students should be able to:

    4. Analyze a security policy for its completeness.
    4.1 Determine information classifications for security policies.
    4.2 Identify the information owners of an organization.

    5. Show a familiarity with a wide range of substantive issues in IS security policy creation.

    5.1 Indicate the different types of information assets.

    Reading Assignment

    Chapter 5: Asset Management and Data Loss Prevention

    Unit Lesson

    A major benefit of creating a policy is to protect the assets and prevention of types of data loss. If we fail to
    create these policies, then we increase our chances of the data loss or potential theft of the assets. The first
    phase of protecting the assets is to determine the values and importance to the organization. For example, if
    we have Cisco equipment that costs $250,000, then policies should be in place to protect this hardware. On
    the other hand, you may have a router or specialty equipment with less value; this does not mean it should
    not have a policy assigned to the equipment, but it can be grouped into a classification for general use and
    best practices. We would not want to spend 20 hours working on an asset policy for assets with a value of
    $5,000. At some point, there are diminishing returns, so proper planning and good decision-making are
    needed when examining the need for asset management policies. We also have to take into consideration the
    need for further updates as we make the decisions.

    Classifications

    The identification and classification of the information assets and systems are essential to protect against
    confidentiality, integrity, and availability (Santos, 2019). The National Institute for Standards and Technology
    (NIST) (2018) uniquely identifies assets (components) based on known identifiers and/or known information
    about the assets. Therefore, we can group or combine the assets for common policy practices. Asset
    management provides a framework or process to ensure that assets are adequately protected. An example of
    an asset management methodology is tracking and inventorying IT hardware and software. Additionally, it is
    recommended that organizations identify if there is an asset management system that needs to be included in
    the policy. Some of the private classifications are listed below.

    Protected: Data that is protected by law, regulation, memorandum of agreement, contractual obligation, or
    management discretion are considered protected (Santos, 2019). It is in this situation that organizations need
    to protect the nonpublic information from external personnel, employees without the proper access rights, and
    criminals. If you work for a financial institution, the entity will have its customer’s social security number,
    address, account numbers, and credit scores. This information needs to be protected because it is classified.

    Confidential: Confidential information should only be accessible and viewed by those individuals that an
    organization has deemed trustworthy and within the appropriate level. Santos (2019) provided examples of
    business strategies, financial positions, employee records, upcoming sales or advertising campaigns,
    laboratory research, and product schematics as confidential artifacts. It is obvious for this classification an
    organization may want its chief financial officer (CFO) to have access to the financial records and balance
    sheets, but not necessarily the laboratory research. Therefore, the classification of confidential should not

    UNIT V STUDY GUIDE
    Protecting Organizational Assets and Data

    SEC 4303, IS Security Policy Analysis 2

    UNIT x STUDY GUIDE
    Title

    only apply to the most trustworthy personnel, but should also be appropriate to the department. In the case of
    the laboratory research, a CFO may not understand the full importance of the information he or she has, so
    he or she could accidently discard the information in a trash bin. However, a CFO would certainly protect the
    end-of-year financial reports because he or she understands the importance of protecting the information.

    Internal use: If the information or data are classified for internal use, then that information should only be
    distributed within the organization. We have seen information technology (IT) take a proactive role in disabling
    SharePoint site links for only internal personnel. For example, as part of Office 365 and One Drive,
    employees usually have the option to share a document or spreadsheet, but if this information is classified as
    internal use only, then the OneDrive links should be locked from sharing with anyone outside the domain or
    active directory.

    Public: Public information is certainly the less stringent classification. An organization may have marketing
    material, product brochures, or annual reports. This information is usually readily available to the public, so it
    is not detrimental if the information is sent outside the organization. However, management and possibly the
    legal department should approve any modifications or adjustments to the information.

    Organizations can review more information on the asset management standards by reviewing the ISO 55000
    standard. The ISO 55000 series is comprised of three standards. ISO 55000 is an overview of the subject of
    asset management and the standard terms and definitions, ISO 55001 is the requirements specification for an
    integrated, effective management system for asset management, and ISO 55002 provides guidance for the
    implementation of such a management system (The Woodhouse Partnership, 2018). We can use these
    standards when creating the information system (IS) security policies for asset management. Knowing what
    the organization has, where everything is, its importance, and ownership are important pieces to asset
    management.

    The following site explores a great outline for creating a policy using ISO 550001. In the article, you will find
    the importance of alignment, top management support, business objectives, purposes, and communication of
    the policy. The article states the policy should be short, consistent with the overall goals and other policies,
    provide guidance, and have common elements found with other policies. We previously discussed the
    importance of using templates or common headings to ensure everyone uses a standard and approved
    format.

    Dunn, S. (n.d.). How to write a good asset management policy – Implementing ISO 55000.

    https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-
    a-good-asset-management-policy.html

    We now understand assets are important to protect, consequently, we need to define how IS assets relate to
    the organization. Santos (2019) explains that an information asset is a definable piece of information that is
    recognized as having value. Therefore, the information residing on our databases is of value to our
    operations, so it is considered an information asset. If you become an IT manager, then your department
    should develop an asset strategy to include information assets, software assets, and information technology
    equipment.

    Consider the information the employees have when it comes to procedures or intellectual property. Santos
    (2019) outlines data warehouses, intellectual property, and operation procedures as information assets. An
    asset management strategy is a broad level plan set by senior management as a guide to how an
    organization intends to protect assets, ranging from legislative mandates (and their enforcement) to policies to
    technical security controls. Information and physical assets must be protected throughout their life cycle, from
    creation or purchase through final disposal or long-term storage. As we have learned, with the importance of
    identifying the information assets, there is also a need to assign accountability to manage these assets.

    Are employees considered an asset in an organization’s asset management strategy?

    [https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html](https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html)

    [https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html](https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html)

    SEC 4303, IS Security Policy Analysis 3

    UNIT x STUDY GUIDE
    Title

    The key concept is to determine the ownership of the information assets. Some of the most important
    elements to consider when developing an asset management strategy are:

    • inventory assets,
    • definition of responsibility and ownership,
    • importance,
    • establishment of acceptable use policies for information and assets, and
    • protection.

    A best practice is for the data owner to also function as a secondary champion to embrace the
    confidentiality, integrity, and availability (CIA) model (Santos, 2019). We want the staff employees to be
    users of the information, but we need data owners, such as supervisors or management, to ensure the
    policies are being enforced to protect the assets.

    Once the data owners are identified, then the information security owner needs to work with these individuals
    to review existing policies or create new ones. The information security officer (ISO) should provide direction
    and guidance as to the appropriate controls and ensure that controls are applied consistently throughout the
    organization (Santos, 2019). It is certainly an ideal situation to have a designated employee with the role of
    the ISO, but this is not always the case in most organizations because of resources or budget limitations.
    Many organizations have ineffective or insufficient policies simply because they have not been updated.
    Additionally, there needs to be clear communication between the users, data owners, and information security
    officer regarding these policies.

    Summary

    As found in Chapter 5, information can be classified by confidentiality, integrity, and availability factors.
    Santos (2019) also discussed how national security applies classification to top secret, secret, confidential,
    unclassified, and sensitive/but classified information. In business, we can review the sensitivity of the data
    and then assign access controls depending on the group or level of the employee. For example, an accounts
    payable employee should have access to the accounts payable forms or pages, but he or she should not
    have access to the vendors form because this employee could create a vendor for a family member and then

    Data owner responsibilities
    (Adapted from Santos, 2019)

    What would be the value and impact of creating a policy to address the information
    assets, but not assigning teams or groups with a responsibility for the protections?

    SEC 4303, IS Security Policy Analysis 4

    UNIT x STUDY GUIDE
    Title

    send payments. However, the chief financial officer (CFO) should have access to all forms and ensure the
    payables policies are followed. Therefore, it is extremely important for IT and human resources (HR) to
    constantly work together to ensure the employees have access to the appropriate information depending on
    their roles within the organization. A large organization may have well-defined processes for this alignment,
    while most small- or medium-size businesses may be set up as verbal rather than formal policies.

    References

    The Woodhouse Partnership. (2018). Latest news in standards for asset management. ISO 55000 Standards

    for Asset Management. https://www.assetmanagementstandards.com/

    National Institute of Standards and Technology. (2018). Computer security resource center: Asset

    identification. https://csrc.nist.gov/glossary/term/Asset-Identification

    Santos, O. (2019). Developing cybersecurity programs and policies (3rd ed.). Upper Saddle River, NJ:

    Pearson.

    – Course Learning Outcomes for Unit V
    – Reading Assignment
    – Unit Lesson

    **## V.docx**

    Should organizations have data or information owners? Please explain why or why not. Consider the costs, roles, and responsibilities for the data and information.

    Course Textbook(s)

    Santos, O. (2019). Developing cybersecurity programs and policies (3rd ed.). Pearson. https://online.vitalsource.com/#/books/9780134858548

    **## UnitV.pdf**

    SEC 4303, IS Security Policy Analysis 1

    Course Learning Outcomes for Unit V

    Upon completion of this unit, students should be able to:

    4. Analyze a security policy for its completeness.
    4.1 Determine information classifications for security policies.
    4.2 Identify the information owners of an organization.

    5. Show a familiarity with a wide range of substantive issues in IS security policy creation.

    5.1 Indicate the different types of information assets.

    Reading Assignment

    Chapter 5: Asset Management and Data Loss Prevention

    Unit Lesson

    A major benefit of creating a policy is to protect the assets and prevention of types of data loss. If we fail to
    create these policies, then we increase our chances of the data loss or potential theft of the assets. The first
    phase of protecting the assets is to determine the values and importance to the organization. For example, if
    we have Cisco equipment that costs $250,000, then policies should be in place to protect this hardware. On
    the other hand, you may have a router or specialty equipment with less value; this does not mean it should
    not have a policy assigned to the equipment, but it can be grouped into a classification for general use and
    best practices. We would not want to spend 20 hours working on an asset policy for assets with a value of
    $5,000. At some point, there are diminishing returns, so proper planning and good decision-making are
    needed when examining the need for asset management policies. We also have to take into consideration the
    need for further updates as we make the decisions.

    Classifications

    The identification and classification of the information assets and systems are essential to protect against
    confidentiality, integrity, and availability (Santos, 2019). The National Institute for Standards and Technology
    (NIST) (2018) uniquely identifies assets (components) based on known identifiers and/or known information
    about the assets. Therefore, we can group or combine the assets for common policy practices. Asset
    management provides a framework or process to ensure that assets are adequately protected. An example of
    an asset management methodology is tracking and inventorying IT hardware and software. Additionally, it is
    recommended that organizations identify if there is an asset management system that needs to be included in
    the policy. Some of the private classifications are listed below.

    Protected: Data that is protected by law, regulation, memorandum of agreement, contractual obligation, or
    management discretion are considered protected (Santos, 2019). It is in this situation that organizations need
    to protect the nonpublic information from external personnel, employees without the proper access rights, and
    criminals. If you work for a financial institution, the entity will have its customer’s social security number,
    address, account numbers, and credit scores. This information needs to be protected because it is classified.

    Confidential: Confidential information should only be accessible and viewed by those individuals that an
    organization has deemed trustworthy and within the appropriate level. Santos (2019) provided examples of
    business strategies, financial positions, employee records, upcoming sales or advertising campaigns,
    laboratory research, and product schematics as confidential artifacts. It is obvious for this classification an
    organization may want its chief financial officer (CFO) to have access to the financial records and balance
    sheets, but not necessarily the laboratory research. Therefore, the classification of confidential should not

    UNIT V STUDY GUIDE
    Protecting Organizational Assets and Data

    SEC 4303, IS Security Policy Analysis 2

    UNIT x STUDY GUIDE
    Title

    only apply to the most trustworthy personnel, but should also be appropriate to the department. In the case of
    the laboratory research, a CFO may not understand the full importance of the information he or she has, so
    he or she could accidently discard the information in a trash bin. However, a CFO would certainly protect the
    end-of-year financial reports because he or she understands the importance of protecting the information.

    Internal use: If the information or data are classified for internal use, then that information should only be
    distributed within the organization. We have seen information technology (IT) take a proactive role in disabling
    SharePoint site links for only internal personnel. For example, as part of Office 365 and One Drive,
    employees usually have the option to share a document or spreadsheet, but if this information is classified as
    internal use only, then the OneDrive links should be locked from sharing with anyone outside the domain or
    active directory.

    Public: Public information is certainly the less stringent classification. An organization may have marketing
    material, product brochures, or annual reports. This information is usually readily available to the public, so it
    is not detrimental if the information is sent outside the organization. However, management and possibly the
    legal department should approve any modifications or adjustments to the information.

    Organizations can review more information on the asset management standards by reviewing the ISO 55000
    standard. The ISO 55000 series is comprised of three standards. ISO 55000 is an overview of the subject of
    asset management and the standard terms and definitions, ISO 55001 is the requirements specification for an
    integrated, effective management system for asset management, and ISO 55002 provides guidance for the
    implementation of such a management system (The Woodhouse Partnership, 2018). We can use these
    standards when creating the information system (IS) security policies for asset management. Knowing what
    the organization has, where everything is, its importance, and ownership are important pieces to asset
    management.

    The following site explores a great outline for creating a policy using ISO 550001. In the article, you will find
    the importance of alignment, top management support, business objectives, purposes, and communication of
    the policy. The article states the policy should be short, consistent with the overall goals and other policies,
    provide guidance, and have common elements found with other policies. We previously discussed the
    importance of using templates or common headings to ensure everyone uses a standard and approved
    format.

    Dunn, S. (n.d.). How to write a good asset management policy – Implementing ISO 55000.

    https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-
    a-good-asset-management-policy.html

    We now understand assets are important to protect, consequently, we need to define how IS assets relate to
    the organization. Santos (2019) explains that an information asset is a definable piece of information that is
    recognized as having value. Therefore, the information residing on our databases is of value to our
    operations, so it is considered an information asset. If you become an IT manager, then your department
    should develop an asset strategy to include information assets, software assets, and information technology
    equipment.

    Consider the information the employees have when it comes to procedures or intellectual property. Santos
    (2019) outlines data warehouses, intellectual property, and operation procedures as information assets. An
    asset management strategy is a broad level plan set by senior management as a guide to how an
    organization intends to protect assets, ranging from legislative mandates (and their enforcement) to policies to
    technical security controls. Information and physical assets must be protected throughout their life cycle, from
    creation or purchase through final disposal or long-term storage. As we have learned, with the importance of
    identifying the information assets, there is also a need to assign accountability to manage these assets.

    Are employees considered an asset in an organization’s asset management strategy?

    [https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html](https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html)

    [https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html](https://www.assetivity.com.au/article/asset-management/implementing-iso-55000-part-3-how-to-write-a-good-asset-management-policy.html)

    SEC 4303, IS Security Policy Analysis 3

    UNIT x STUDY GUIDE
    Title

    The key concept is to determine the ownership of the information assets. Some of the most important
    elements to consider when developing an asset management strategy are:

    • inventory assets,
    • definition of responsibility and ownership,
    • importance,
    • establishment of acceptable use policies for information and assets, and
    • protection.

    A best practice is for the data owner to also function as a secondary champion to embrace the
    confidentiality, integrity, and availability (CIA) model (Santos, 2019). We want the staff employees to be
    users of the information, but we need data owners, such as supervisors or management, to ensure the
    policies are being enforced to protect the assets.

    Once the data owners are identified, then the information security owner needs to work with these individuals
    to review existing policies or create new ones. The information security officer (ISO) should provide direction
    and guidance as to the appropriate controls and ensure that controls are applied consistently throughout the
    organization (Santos, 2019). It is certainly an ideal situation to have a designated employee with the role of
    the ISO, but this is not always the case in most organizations because of resources or budget limitations.
    Many organizations have ineffective or insufficient policies simply because they have not been updated.
    Additionally, there needs to be clear communication between the users, data owners, and information security
    officer regarding these policies.

    Summary

    As found in Chapter 5, information can be classified by confidentiality, integrity, and availability factors.
    Santos (2019) also discussed how national security applies classification to top secret, secret, confidential,
    unclassified, and sensitive/but classified information. In business, we can review the sensitivity of the data
    and then assign access controls depending on the group or level of the employee. For example, an accounts
    payable employee should have access to the accounts payable forms or pages, but he or she should not
    have access to the vendors form because this employee could create a vendor for a family member and then

    Data owner responsibilities
    (Adapted from Santos, 2019)

    What would be the value and impact of creating a policy to address the information
    assets, but not assigning teams or groups with a responsibility for the protections?

    SEC 4303, IS Security Policy Analysis 4

    UNIT x STUDY GUIDE
    Title

    send payments. However, the chief financial officer (CFO) should have access to all forms and ensure the
    payables policies are followed. Therefore, it is extremely important for IT and human resources (HR) to
    constantly work together to ensure the employees have access to the appropriate information depending on
    their roles within the organization. A large organization may have well-defined processes for this alignment,
    while most small- or medium-size businesses may be set up as verbal rather than formal policies.

    References

    The Woodhouse Partnership. (2018). Latest news in standards for asset management. ISO 55000 Standards

    for Asset Management. https://www.assetmanagementstandards.com/

    National Institute of Standards and Technology. (2018). Computer security resource center: Asset

    identification. https://csrc.nist.gov/glossary/term/Asset-Identification

    Santos, O. (2019). Developing cybersecurity programs and policies (3rd ed.). Upper Saddle River, NJ:

    Pearson.

    – Course Learning Outcomes for Unit V
    – Reading Assignment
    – Unit Lesson

  • [Solved] Failed Software Project

    ✓ Verified Academic Solution Available

    Executive Solution Overview

    – Your business sponsor is concerned that your project may fail. As you know, developing software applications is very risky; thus, failure is a distinct option. Using a project that you have experience with or locate online, describe why software development projects fail, and how to reduce the ris…

    Instant Solution Download

    $6.99

    Immediate access to the full model answer, formatted citations, and rubric breakdown.

    Need a Fresh Custom Paper?

    Have this question answered from scratch according to your specific instructions and deadline.

    Order on TutorsGallery →

    Assignment Prompt & Instructions

    – Your business sponsor is concerned that your project may fail. As you know, developing software applications is very risky; thus, failure is a distinct option. Using a project that you have experience with or locate online, describe why software development projects fail, and how to reduce the risk of failure based upon the materials from this week. Justify your response.

    – a year ago

  • [Solved] Technology Transfer Research Paper

    ✓ Verified Academic Solution Available

    Executive Solution Overview

    ## Technology Transfer Research Paper ## Objective The purpose of this Technology Transfer Research Paper is to gather and summarize authoritative information about how technologies are transitioned from the Research & Development (R&D) lab to the product development organizations which incorporate …

    Instant Solution Download

    $6.99

    Immediate access to the full model answer, formatted citations, and rubric breakdown.

    Need a Fresh Custom Paper?

    Have this question answered from scratch according to your specific instructions and deadline.

    Order on TutorsGallery →

    Assignment Prompt & Instructions

    ## Technology Transfer Research Paper

    ## Objective

    The purpose of this Technology Transfer Research Paper
    is to gather and summarize authoritative information about how technologies are
    transitioned from the Research & Development (R&D) lab to the product
    development organizations which incorporate leading and emerging technologies
    into new products and services.

    ## Overview

    Your task is to research, analyze, and discuss the
    processes involved in helping technologies emerge (“transition”) from the
    R&D environment to product development organizations so that the
    technologies can be incorporated into products and services which meet the
    needs of the consumers, businesses, and government agencies. Your research
    should include technology transfer processes and initiatives along with funding
    sources, i.e. venture capital, government grants, etc. You should also address
    the technology development lifecycle and the role of funding availability at
    each of the lifecycle stages (See NIST GCR 02-841). Address what happens when
    adequate funding is not readily available and what impacts that deficiency has
    upon the development and transitioning of technologies from labs to products.

    To begin, review the following documents and resources
    about technology transfer processes and initiatives. Continue your research by
    investigating the availability (or lack) of federal funding for innovations in
    the cybersecurity area.

    ·_What is a_
    _technology?_ [http://www.esa.int/Our_Activities/Space_Engineering_Technology/What_is_technology](http://www.esa.int/Our_Activities/Space_Engineering_Technology/What_is_technology)

    ·_Between_
    _Invention and Innovation: An Analysis of Funding for Early-Stage Technology_
    _Development (NIST GCR 02–841)_

    [https://www.nist.gov/system/files/documents/2017/05/09/gcr02-841.pdf](https://www.nist.gov/system/files/documents/2017/05/09/gcr02-841.pdf)(you must
    use this exact version)

    ·_What is technology_
    _transfer?_ [https://www.doi.gov/techtransfer](https://www.doi.gov/techtransfer)

    ·_Technology_
    _Transfer @ DHS_

    o[https://www.dhs.gov/science-and-technology/technology-transfer-program](https://www.dhs.gov/science-and-technology/technology-transfer-program)

    o[https://www.dhs.gov/sites/default/files/publications/t2c_factsheet-final.pdf](https://www.dhs.gov/sites/default/files/publications/t2c_factsheet-final.pdf)

    Next, research the role that private funding
    (venture capital) plays in providing money and resources to innovators who are
    developing cybersecurity technologies and products. How does the availability
    of venture capital impact the development of technology? How do venture
    capitalists influence the emergence or death of technology developments?
    Provide specific examples from your research.

    The following information needs must be met by the
    deliverable for this assignment.

    (a)Introduction and
    Overview

    a.Technology
    Transfer Processes

    b.Technology
    Development Life Cycle (per NIST GRC 02-841)

    c.Funding Sources
    & Issues

    (b)Explanation of
    the Phases of the Technology Development Life Cycle (per NIST GRC 02-841) with
    examples of activities in each phase

    (c)Explanation of
    Technology Transfer Processes

    a.Identify and
    Discuss Key Players, i.e. inventors, universities, companies, and investors

    b.Examples of
    Technology Transfer in two or more phases of the technology lifecycle

    (d)Explanation of
    Funding Sources & Issues

    a.What role does
    funding play in the technology transfer process? (Encourage? Discourage? Shape
    decision making?)

    b.Who are the key
    players involved in funding decisions?

    c.Examples of
    funding sources supporting two or more phases of the technology lifecycle

    (e)Summary and
    Conclusions

    a.Why do inventors
    and others need to understand Technology Transfer

    b.Why do inventors
    and others need to understand the role of funding in encouraging and/or
    discouraging technology R&D

    Your research is to be incorporated into a 4 to 6 page
    written summary of the technology transfer process and associated funding
    issues. (Follow the outline above and review the explanations provided in the
    rubric.) Your report is to be submitted as an MS Word attachment to the _Technology Transfer Research Paper_ entry
    in your assignments folder.

    ### Additional Information

    1.Consult the grading rubric for specific
    content and formatting requirements for this assignment.

    2.Your 4 – 6 page research paper should be
    professional in appearance with consistent use of fonts, font sizes, margins,
    etc. You should use headings and page breaks to organize your paper.

    3.Your paper should use standard terms and
    definitions for cybersecurity.

    4.The CSIA program recommends that you follow
    standard APA formatting since this will give you a document that meets the
    “professional appearance” requirements. APA formatting guidelines and examples
    are found under Course Resources. An APA template file (MS Word format) has
    also been provided for your use. The file name is: CSIA_Paper_Template(TOC+TOF,2021).docx

    5.You must include a cover page with the
    assignment title, your name, and the due date. Your reference list must be on a
    separate page at the end of your file. These pages do not count towards the
    assignment’s page count.

    6.You are expected to write grammatically
    correct English in every assignment that you submit for grading. Do not turn in
    any work without (a) using spell check, (b) using grammar check, (c) verifying
    that your punctuation is correct and (d) reviewing your work for correct word
    usage and correctly structured sentences and paragraphs.

    7.You are expected to credit your sources using
    in-text citations and reference list entries. Both your citations and your
    reference list entries must follow a consistent and professional citation style
    (APA, MLA, etc.).

    – [\
    \
    CSIA459TechTransferResearchPaperv2023.docx](https://www.sweetstudy.com/files/csia459techtransferresearchpaperv2023-docx "CSIA459TechTransferResearchPaperv2023.docx")

    – a year ago

  • [Solved] please read below

    ✓ Verified Academic Solution Available

    Executive Solution Overview

    **Case Study** **PowerPoint Assignment: WLAN Implementation at Vincent Medical Center** **Objective:** Create a professional PowerPoint presentation to educate the staff of Vincent Medical Center (VMC) on the use and benefits of Wireless Local Area Networks (WLANs) within their facility. **Scenario:…

    Instant Solution Download

    $6.99

    Immediate access to the full model answer, formatted citations, and rubric breakdown.

    Need a Fresh Custom Paper?

    Have this question answered from scratch according to your specific instructions and deadline.

    Order on TutorsGallery →

    Assignment Prompt & Instructions

    **Case Study**

    **PowerPoint Assignment: WLAN Implementation at Vincent Medical Center**

    **Objective:**

    Create a professional PowerPoint presentation to educate the staff of Vincent Medical Center (VMC) on the use and benefits of Wireless Local Area Networks (WLANs) within their facility.

    **Scenario:**

    You are a consultant from The Baypoint Group (TBG), recently assigned to work with VMC. This large healthcare facility is considering upgrading its network infrastructure to include a comprehensive WLAN solution. Your task is to create a PowerPoint presentation addressing the feasibility, advantages, and considerations of deploying a WLAN across its two-building campus.

    Create a **PowerPoint presentation** that includes:

    01. **Title Slide**

    – Presentation title
    – Your name
    – Course number (e.g., ISSC343)
    – Assignment title (e.g., Week 3 PowerPoint Assignment)
    02. **Introduction Slide**

    – Brief overview of VMC’s current network limitations
    – Importance of real-time data access in healthcare settings
    03. **Mobility Benefits**

    – Explain how WLANs improve mobility for doctors and nurses
    – Example: Accessing patient records or prescriptions bedside via tablets
    04. **Installation and Cost Efficiency**

    – Compare costs and time of WLAN vs. wired installations
    – Emphasize reduction in physical cabling requirements
    05. **Network Flexibility**

    – Discuss how WLANs allow for easier modifications and expansions
    – Example: Adding new workstations or mobile medical equipment
    06. **Network Reliability**

    – Overview of WLAN reliability improvements
    – Considerations such as redundant access points and load balancing
    07. **Radio Signal Interference**

    – Define interference and common sources in medical environments
    – Outline mitigation techniques (e.g., spectrum analysis, proper AP placement)
    08. **WLAN Security Considerations**

    – Explain common WLAN threats (e.g., eavesdropping, unauthorized access)
    – Recommend basic security measures (WPA3, network segmentation, NAC)
    09. **Technical Concepts (LO1 & LO2)**

    – Define decibels, gain, and loss in wireless communication (LO1)
    – Describe the function of antennas in wireless networks and their role in performance (LO2)
    10. **Conclusion & Recommendation**

    – Summarize benefits and key considerations
    – Recommend next steps for WLAN implementation at VMC

    1. **References Slide**

    – Include APA-style citations for textbook, research, or relevant sources

    – a year ago

  • [Solved] Project #3: IT Audit Policy and Plans

    ✓ Verified Academic Solution Available

    Executive Solution Overview

    Project #3: IT Audit Policy and Plans Company Background & Operating Environment Red Clay Renovations is an internationally recognized, awarding winning firm that specializes in the renovation and rehabilitation of residential buildings and dwellings. The company specializes in updating homes using …

    Instant Solution Download

    $6.99

    Immediate access to the full model answer, formatted citations, and rubric breakdown.

    Need a Fresh Custom Paper?

    Have this question answered from scratch according to your specific instructions and deadline.

    Order on TutorsGallery →

    Assignment Prompt & Instructions

    Project #3: IT Audit Policy and Plans

    Company Background & Operating Environment

    Red Clay Renovations is an internationally recognized, awarding winning firm that specializes in the renovation and rehabilitation of residential buildings and dwellings. The company specializes in updating homes using “smart home” and “Internet of Things” technologies while maintaining period correct architectural characteristics. Please refer to the company profile (for additional background information and information about the company’s operating environment.

    Policy Issue & Plan of Action

    The corporate board was recently briefed by the Chief Information Officer concerning the company’s IT Security Program and how this program contributes to the company’s risk management strategy. During the briefing, the CIO presented assessment reports and audit findings from IT security audits. These audits focused upon the technical infrastructure and the effectiveness and efficiency of the company’s implementation of security controls. During the discussion period, members of the corporate board asked about audits of policy compliance and assessments as to the degree that employees were (a) aware of IT security policies and (b) complying with these policies. The Chief Information Officer was tasked with providing the following items to the board before its next quarterly meeting:

    (a) Issue Specific Policy requiring an annual compliance audit for IT security policies as documented in the company’s Policy System

    (b) Audit Plan for assessing employee awareness of and compliance with IT security policies

    a. Are employees aware of the IT security policies in the Employee Handbook?

    b. Do employees know their responsibilities under those policies?

    (c) Audit Plan for assessing the IT security policy system

    a. Do required policies exist?

    b. Have they been updated within the past year?

    c. Are the policies being reviewed and approved by the appropriate oversight authorities (managers, IT governance board, etc.)?

    Your Task Assignment

    As a staff member supporting the CISO, you have been asked to research this issue (auditing IT security policy compliance) and then prepare an “approval draft” for a compliance policy. You must also research and draft two separate audit plans (a) employee compliance and (b) policy system audit. The audit policy should not exceed two typed pages in length so you will need to be concise in your writing and only include the most important elements for the policy. Make sure that you include a requirement for an assessment report to be provided to company management and the corporate board of directors.

    • For the employee compliance assessment, you must use an interview strategy which includes 10 or more multiple choice questions that can be used to construct a web-based survey of all employees. The questions should be split between (a) awareness of key policies and (b) awareness of personal responsibilities in regards to compliance.

    • For the policy system audit, you should use a documentation assessment strategy which reviews the contents of the individual policies to determine when the policy was last updated, who “owns” the policy, who reviewed the policy, and who approved the policy for implementation.

    Research:

    1. Review the table of contents and relevant chapters in the Certified Information Privacy Professional textbook to find information about legal and regulatory drivers.

    2. Review the weekly readings including the example audit assessment report.

    3. Review work completed previously in this course which provides background about the IT Policy System and specific policies for the case study company.

    4. Find additional resources which discuss IT compliance audits and/or policy system audits.

    Write:

    1. Prepare briefing package with approval drafts of the three required documents. Place all three documents in a single MS Word (.doc or .docx) files.

    2. Your briefing package must contain the following:

    • Executive Summary

    • “Approval Drafts” for

    o Issue Specific Policy for IT Security Policy Compliance Audits

    o Audit Plan for IT Security Policy Awareness & Compliance (Employee Survey)

    o Audit Plan for IT Security Policies Audit (Documentation Review)

    As you write your policy and audit plans, make sure that you address security issues using standard cybersecurity terminology.

    3. Use a professional format for your policy documents and briefing package. Your policy documents should be consistently formatted and easy to read.

    4. You must include a cover page with the assignment title, your name, and the due date. Your reference list must be on a separate page at the end of your file. These pages do not count towards the assignment’s page count.

    5. Common phrases do not require citations. If there is doubt as to whether or not information requires attribution, provide a footnote with publication information or use APA format citations and references.

    6. You are expected to write grammatically correct English in every assignment that you submit for grading. Do not turn in any work without (a) using spell check, (b) using grammar check, (c) verifying that your punctuation is correct and (d) reviewing your work for correct word usage and correctly structured sentences and paragraphs.

    7. Consult the grading rubric for specific content and formatting requirements for this assignment.

    8. Submit your briefing package in MS Word format (.docx or .doc file) for grading using your assignment folder. (Attach the file.)

    – [\
    \
    CSIA413Project3AuditPolicyandPlansv2022.docx](https://www.sweetstudy.com/files/csia413project3auditpolicyandplansv2022-docx "CSIA413Project3AuditPolicyandPlansv2022.docx")

    – a year ago

  • [Solved] please read below for further instructions

    ✓ Verified Academic Solution Available

    Executive Solution Overview

    We are a highly technical society. Our everyday lives revolve around the Internet: we benefit from the Internet, but we can also be victims of cyber criminals. To understand how criminals use the Internet to their advantage, one must understand how we communicate on the Internet. In this paper, you …

    Instant Solution Download

    $6.99

    Immediate access to the full model answer, formatted citations, and rubric breakdown.

    Need a Fresh Custom Paper?

    Have this question answered from scratch according to your specific instructions and deadline.

    Order on TutorsGallery →

    Assignment Prompt & Instructions

    We are a highly technical society.  Our everyday lives revolve around the Internet: we benefit from the Internet, but we can also be victims of cyber criminals.  To understand how criminals use the Internet to their advantage, one must understand how we communicate on the Internet.  In this paper, you are required to describe in detail how we communicate on the Internet, based upon your readings.  Discuss the major networking building blocks and their functions.  Secondly, discuss software applications' vulnerabilities, such as those found in web browser

    1. Document Format.

    a.  MS Word document

    b.  One-inch (1”) margins

    c.  Times New Roman font

    d.  Twelve (12) pitch

    e.  Not including your title page, this assignment should be 4-6 pages.

    f.  Double space, except for your bibliography’s citations.

    g. You must use 5 scholarly sources in supporting this assignment.

    2. Citation Format: _The Chicago Manual of Style._ As stated in the Academic Integrity Briefings, information taken directly from another source must be placed in quotations and cited following the Chicago format contained in the week one “lessons” folder. You must cite all other information from your sources, even if you do not quote directly. DIRECT QUOTING SHOULD BE KEPT TO A MINIMUM.

    – a year ago

  • [Solved] Internship Reflective Project

    ✓ Verified Academic Solution Available

    Executive Solution Overview

    I need help completeling this project, I can send you all the info you need to complete it, but I am also open to ideas – a year ago **files (1)** – ## PracticumPresentationInstructionsandReflectivepaper.docx **## PracticumPresentationInstructionsandReflectivepaper.docx** **Practicum Presentation In…

    Instant Solution Download

    $6.99

    Immediate access to the full model answer, formatted citations, and rubric breakdown.

    Need a Fresh Custom Paper?

    Have this question answered from scratch according to your specific instructions and deadline.

    Order on TutorsGallery →

    Assignment Prompt & Instructions

    I need help completeling this project, I can send you all the info you need to complete it, but I am also open to ideas

    – a year ago

    **files (1)**

    – ## PracticumPresentationInstructionsandReflectivepaper.docx

    **## PracticumPresentationInstructionsandReflectivepaper.docx**

    **Practicum Presentation Instructions:**

    Final Practicum Presentation reflects your Practicum experiences and highlights your major projects, activities, and lessons learned. Presentation, like your Reflective Paper, should include

    A) Description and history of Agency

    1. Mission or objective of the h/c organization

    1. Size in terms of patient capacity and staff

    1. Target population serviced

    1. Type of services rendered and/or volume of service

    1. Relationship of institutions to other institutions

    1. Effectiveness in meeting institutional goals

    1. Other notable services or concepts

    B) Department/unit mission, vision, goals, effectiveness (if applicable)

    **C)** Reflections

    1. General observations

    1. Comments regarding your impressions of the facility and its programs and services

    1. Comments about your individual experiences, gains, and growth

    1. Comments about your ability to meet your professional and academic goals

    D) Project report[footnoteRef:1] [1: ]

    1. Description of your project or activities

    1. Interactions

    1. Your contributions

    1. Lessons Learned

    1. Analysis of professional and Personal growth.

    Each student prepares his/her presentation about his/her practicum experiences according to the guidelines above. The presentation can be in any of the following formats- PowerPoint, poster, a monologue with no supporting slides or materials- and should be submitted on the course Blackboard for all classmates to review and learn from your experiences. The presentation length is 10-15 minutes. If the file is too big, please create a YouTube presentation and provide a link.

    Any additional meetings are
    only required if they are recommended by the instructor based on the Practicum Preceptor’s feedback or the student’s request. The student is required to contact the instructor and schedule this additional meeting based on his and the instructor’s availability.

    [**Practicum Reflective Paper**](https://newlearn.govst.edu/webapps/assignment/uploadAssignment?content_id=_2200864_1&course_id=_23585_1&group_id=&mode=view)

    Each student is required to write a 6-10-page learning paper on his or her fieldwork experience.  This paper should include

    · highlights of the student’s work activities and/or projects,

    · “Lessons learned” part that reflects what helped a student to grow professionally and personally how she/he applied her theoretical knowledge to a real-life situation, and

    · a self-evaluation of his or her experiences and skills.

    Below are the major points your reflective Paper should include:

    A) Description and history of Agency

    · Mission or objective of the h/c organization

    · Size in terms of patient capacity and staff

    · Target population serviced

    · Type of services rendered and/or volume of service

    · Relationship of institutions to other institutions

    · Effectiveness in meeting institutional goals

    · Other notable services or concepts

    B) Department/unit mission, vision, goals, effectiveness (if applicable)

    C) Reflections (6-8 pages of a total report)

    · General observations

    · Analysis and evaluation of your individual experiences, professional and personal gains

    · Comments, analysis and evaluation of your ability to meet your professional and academic objectives that were established in your Professional Development Plan

    Steps that you realized you need to take to meet your professional and academic objectives

    This Reflective Paper should be written in APA format and include literature support. The paper is also part of your portfolio, item 6. Detailed instruction of the information to be included in your Reflective paper is included in your syllabus, p. 9.

    **## PracticumPresentationInstructionsandReflectivepaper.docx**

    **Practicum Presentation Instructions:**

    Final Practicum Presentation reflects your Practicum experiences and highlights your major projects, activities, and lessons learned. Presentation, like your Reflective Paper, should include

    A) Description and history of Agency

    1. Mission or objective of the h/c organization

    1. Size in terms of patient capacity and staff

    1. Target population serviced

    1. Type of services rendered and/or volume of service

    1. Relationship of institutions to other institutions

    1. Effectiveness in meeting institutional goals

    1. Other notable services or concepts

    B) Department/unit mission, vision, goals, effectiveness (if applicable)

    **C)** Reflections

    1. General observations

    1. Comments regarding your impressions of the facility and its programs and services

    1. Comments about your individual experiences, gains, and growth

    1. Comments about your ability to meet your professional and academic goals

    D) Project report[footnoteRef:1] [1: ]

    1. Description of your project or activities

    1. Interactions

    1. Your contributions

    1. Lessons Learned

    1. Analysis of professional and Personal growth.

    Each student prepares his/her presentation about his/her practicum experiences according to the guidelines above. The presentation can be in any of the following formats- PowerPoint, poster, a monologue with no supporting slides or materials- and should be submitted on the course Blackboard for all classmates to review and learn from your experiences. The presentation length is 10-15 minutes. If the file is too big, please create a YouTube presentation and provide a link.

    Any additional meetings are
    only required if they are recommended by the instructor based on the Practicum Preceptor’s feedback or the student’s request. The student is required to contact the instructor and schedule this additional meeting based on his and the instructor’s availability.

    [**Practicum Reflective Paper**](https://newlearn.govst.edu/webapps/assignment/uploadAssignment?content_id=_2200864_1&course_id=_23585_1&group_id=&mode=view)

    Each student is required to write a 6-10-page learning paper on his or her fieldwork experience.  This paper should include

    · highlights of the student’s work activities and/or projects,

    · “Lessons learned” part that reflects what helped a student to grow professionally and personally how she/he applied her theoretical knowledge to a real-life situation, and

    · a self-evaluation of his or her experiences and skills.

    Below are the major points your reflective Paper should include:

    A) Description and history of Agency

    · Mission or objective of the h/c organization

    · Size in terms of patient capacity and staff

    · Target population serviced

    · Type of services rendered and/or volume of service

    · Relationship of institutions to other institutions

    · Effectiveness in meeting institutional goals

    · Other notable services or concepts

    B) Department/unit mission, vision, goals, effectiveness (if applicable)

    C) Reflections (6-8 pages of a total report)

    · General observations

    · Analysis and evaluation of your individual experiences, professional and personal gains

    · Comments, analysis and evaluation of your ability to meet your professional and academic objectives that were established in your Professional Development Plan

    Steps that you realized you need to take to meet your professional and academic objectives

    This Reflective Paper should be written in APA format and include literature support. The paper is also part of your portfolio, item 6. Detailed instruction of the information to be included in your Reflective paper is included in your syllabus, p. 9.

  • [Solved] PSY

    ✓ Verified Academic Solution Available

    Executive Solution Overview

    In-depth study guidance and analytical solution covering PSY.

    Instant Solution Download

    $6.99

    Immediate access to the full model answer, formatted citations, and rubric breakdown.

    Need a Fresh Custom Paper?

    Have this question answered from scratch according to your specific instructions and deadline.

    Order on TutorsGallery →

    Assignment Prompt & Instructions

    Full assignment prompt and step-by-step guidance are included in the downloadable solution file.