History and Background State Government Administration - Overview of the CIS EA&G&G&G&G&C&C Safety & Security System
|
|
- Peregrine Bell
- 3 years ago
- Views:
Transcription
1 September 29,
2 History and Background State policy (SAM Section ) requires a plan of action and milestone but gives little to no direction or assistance The California Information Security Office (CISO) released a standardized tool for reporting (with procedures) The POAM Tool is purposely simple to complete and submit 2
3 History and Background Data elements collected will be uniform The Department of Technology and the CISO will be able to aggregate the data and evaluate risks at several organizational levels entity, agency, or statewide Data will reveal and categorize weaknesses - by control/policy, by risk rating, by completion date, and others 3
4 Mission Simple Meaningful Temporary 4
5 Instructions and Use Column E (Describe the Weakness or Area of Non- Compliance): Briefly describe the nature and characteristics of the risk. Column B (NIST Families): Select from drop-down one of the NIST families within the drop down menu that best describes the security audit finding, compliance deficiency, security risk, incident remediation activity, or other gap (henceforth referred to as risk ). Column C (SAM & SIMM Policies): Select from the drop-down one of the SAM sections or Sub-section. Your selection in Column C must align with your section in Column B. 5
6 Instructions and Use Column F (Compensating Controls): Briefly describe any short or long-term compensating controls in play. Column G (Source): Select from drop-down the source activity (how the risk was initially identified). Column H (Describe the Information Asset at Risk): Briefly describe the information asset(s) that may be impacted by this risk. An information asset can be a system, a data element, a person, a facility, a record, a file, a piece of paper, hardware, software, etc. See the definition for this and other terms in SAM Section
7 Instructions and Use Column I (Assigned To): Identify the person(s) responsible for this risk, including name, title and/or classification. By policy, the state entity head (director) is responsible for all risks, but for purposes of the POAM, please indicate who will own the risk and secure the necessary resources (persons or funding) to address the risk. This is the person the CISO may contact for more information. Column J (Plan of Action): Describe the steps the state entity will take to address the risk, including short and longer-term plans. If Plan of Action is significant and includes several major milestones, submit your detailed plan as a separate file. Column K (When First Identified): Record the date when the risk was first identified. 7
8 Instructions and Use Column L (Start Date): Indicate the date you did or will address the risk. Column M (Completion Date): Indicate the projected completion date. NOTE: CISO will know if it s a projected or actual completion date based on the status of the risk. Column N (Status): Select from one of the four (4) status types. NOTE: Even after a risk is reported as "Completed" it must remain on the tool. Column O (Status Date): Use Column O to record the date for the status selected in Column N. 8
9 Instructions and Use Column P (Risk Rating): Use the NIST risk categories described in Special Publication to determine if the risk is a Very Low, Low, Moderate, High, or Very High value. Column Q (Barriers or Constraints): Briefly describe any constraints to remediating this risk. If necessary, a separate file may be submitted to the CISO. NOTE: All files must begin with your Org Code. 9
10 Transformation: Raw Data to Actionable Business Intelligence Statewide Risks Training 7% Remote Access 31% Incident Response 12% Access Controls 5% Media Protection 10% Acquisition 10% Governance 25% Sample Data 10
11 Secure File Transfer (SFT) 11
12 Case Studies For each of the following Case Studies, we need to provide the following information: Simple Description of the Weakness? NIST Family and/or SAM/SIMM Policy? Compensating Controls? Source? Information Asset at Risk? Assigned To? Plan of Action? Barriers of Constraints 12
13 Case #1 Case Studies During a routine meeting with your CIO, you are informed that your Admin Division has purchased a dozen new multi-function copiers/printers and the IT shop has been asked to work with the vendor to install them on the network. No consideration was given to information security during the procurement. Simple Description of the Weakness? NIST Family and/or SAM/SIMM Policy? Compensating Controls? Source? Information Asset at Risk? Assigned To? Plan of Action? Barriers of Constraints 13
14 Case #2 Case Studies An incident is reported that PII was faxed to an out-of-date fax group and 7 of the recipients have no business need to see this PII. Simple Description of the Weakness? NIST Family and/or SAM/SIMM Policy? Compensating Controls? Source? Information Asset at Risk? Assigned To? Plan of Action? Barriers of Constraints 14
15 Case #3 Case Studies Your department has not updated their TRP in 6 years. As you plan to address this risk and out-of-compliance condition, your list of activities are extensive; including 5 major milestones. You report that this risk will not be fully addressed until you test the new plan in the summer of Simple Description of the Weakness? NIST Family and/or SAM/SIMM Policy? Compensating Controls? Source? Information Asset at Risk? Assigned To? Plan of Action? Barriers of Constraints 15
16 Case #4 Case Studies Your budget office has a mission critical financial system running on a Microsoft Server 2003 operating system. The financial application is written in a language that is no longer supported and will not execute on anything but Server Simple Description of the Weakness? NIST Family and/or SAM/SIMM Policy? Compensating Controls? Source? Information Asset at Risk? Assigned To? Plan of Action? Barriers of Constraints 16
17 Case #5 Case Studies Examples from the audience Simple Description of the Weakness? NIST Family and/or SAM/SIMM Policy? Compensating Controls? Source? Information Asset at Risk? Assigned To? Plan of Action? Barriers of Constraints 17
18
POSTAL REGULATORY COMMISSION
POSTAL REGULATORY COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT INFORMATION SECURITY MANAGEMENT AND ACCESS CONTROL POLICIES Audit Report December 17, 2010 Table of Contents INTRODUCTION... 1 Background...1
More informationEVALUATION REPORT. Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review. March 13, 2015 REPORT NUMBER 15-07
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
More informationInformation Security Program Management Standard
State of California California Information Security Office Information Security Program Management Standard SIMM 5305-A September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF CHANGES
More informationDIVISION OF INFORMATION SECURITY (DIS) Information Security Policy IT Risk Strategy V0.1 April 21, 2014
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy IT Risk Strategy V0.1 April 21, 2014 Revision History Update this table every time a new edition of the document is published Date Authored
More informationNATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL INDEPENDENT EVALUATION OF THE NATIONAL CREDIT UNION ADMINISTRATION S COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA)
More informationUnited States Secret Service Enterprise Architecture Review Board (EARB) Project Briefing for NAME OF PROJECT
United States Secret Service Enterprise Architecture Review Board (EARB) Project Briefing for NAME OF PROJECT Presenter Name(s) Date 1 Introduction: An Enterprise Architecture Review Board (EARB) review
More informationLots of Updates! Where do we start?
NIH Security, FISMA and EPLC Lots of Updates! Where do we start? Kay Coupe NIH FISMA Program Coordinator Office of the Chief Information Officer Project Management Community Meeting October 18, 2011 .
More informationHow To Check If Nasa Can Protect Itself From Hackers
SEPTEMBER 16, 2010 AUDIT REPORT OFFICE OF AUDITS REVIEW OF NASA S MANAGEMENT AND OVERSIGHT OF ITS INFORMATION TECHNOLOGY SECURITY PROGRAM OFFICE OF INSPECTOR GENERAL National Aeronautics and Space Administration
More informationIntelligent Vendor Risk Management
Intelligent Vendor Risk Management Cliff Baker, Managing Partner, Meditology Services LeeAnn Foltz, JD Compliance Resource Consultant, WoltersKluwer Law & Business Agenda Why it s Needed Regulatory Breach
More informationInformation Security @ Blue Valley Schools FEBRUARY 2015
Information Security @ Blue Valley Schools FEBRUARY 2015 Student Data Privacy & Security Blue Valley is committed to providing an education beyond expectations to each of our students. To support that
More informationAchieving Security through Compliance
Achieving Security through Compliance Policies, plans, and procedures Table of Contents This white paper was written by: McAfee Foundstone Professional Services Overview...3 The Rock Foundation...3 Governance...3
More informationOverview. FedRAMP CONOPS
Concept of Operations (CONOPS) Version 1.0 February 7, 2012 Overview Cloud computing technology allows the Federal Government to address demand from citizens for better, faster services and to save resources,
More informationFinal Audit Report. Report No. 4A-CI-OO-12-014
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Subject: AUDIT OF THE INFORMATION TECHNOLOGY SECURITY CONTROLS OF THE U.S. OFFICE OF PERSONNEL MANAGEMENT'S
More informationIndependent Evaluation of NRC s Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2015
Independent Evaluation of NRC s Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2015 OIG-16-A-03 November 12, 2015 All publicly available OIG reports (including
More informationIn Brief. Smithsonian Institution Office of the Inspector General
In Brief Smithsonian Institution Office of the Inspector General Smithsonian Institution Network Infrastructure (SINet) Report Number A-09-01, September 30, 2009 Why We Did This Audit Under the Federal
More informationUNITED STATES DEPARTMENT OF AGRICULTURE FOOD SAFETY AND INSPECTION SERVICE WASHINGTON, DC INFORMATION SYSTEM CERTIFICATION AND ACCREDITATION (C&A)
UNITED STATES DEPARTMENT OF AGRICULTURE FOOD SAFETY AND INSPECTION SERVICE WASHINGTON, DC FSIS DIRECTIVE 1306.2 9/28/11 INFORMATION SYSTEM CERTIFICATION AND ACCREDITATION (C&A) I. PURPOSE This directive
More informationBPA Policy 434-1 Cyber Security Program
B O N N E V I L L E P O W E R A D M I N I S T R A T I O N BPA Policy Table of Contents.1 Purpose & Background...2.2 Policy Owner... 2.3 Applicability... 2.4 Terms & Definitions... 2.5 Policy... 5.6 Policy
More informationTechnology Recovery Plan Instructions
State of California California Information Security Office Technology Recovery Plan Instructions SIMM 5325-A (Formerly SIMM 65A) September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF
More information5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE
5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE 5 FAH-11 H-510 GENERAL (Office of Origin: IRM/IA) 5 FAH-11 H-511 INTRODUCTION 5 FAH-11 H-511.1 Purpose a. This subchapter implements the policy
More informationSMITHSONIAN INSTITUTION
SMITHSONIAN INSTITUTION FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) 2012 INDEPENDENT EVALUATION REPORT TABLE OF CONTENTS PURPOSE 1 BACKGROUND 1 OBJECTIVES, SCOPE, AND METHODOLOGY 2 SUMMARY OF RESULTS
More informationThe Protection Mission a constant endeavor
a constant endeavor The IT Protection Mission a constant endeavor As businesses become more and more dependent on IT, IT must face a higher bar for preparedness Cyber preparedness is the process of ensuring
More informationComplying with the Federal Information Security Management Act. Parallels with Sarbanes-Oxley Compliance
WHITE paper Complying with the Federal Information Security Management Act How Tripwire Change Auditing Solutions Help page 2 page 3 page 3 page 3 page 4 page 4 page 5 page 5 page 6 page 6 page 7 Introduction
More informationCOTS/SaaS Acquisition Information Form
State of California Department of Technology COTS/SaaS Acquisition Information Form Preparation Instructions Statewide Information Management Manual Section 22A June 2015 Table of Contents 1.0 Overview...
More informationImplementing an Information Governance Program CIGP Installment 2: Building Your IG Roadmap by Rick Wilson, Sherpa Software
Implementing an Information Governance Program CIGP Installment 2: Building Your IG Roadmap by Rick Wilson, Sherpa Software www.sherpasoftware.com 1.800.255.5155 @sherpasoftware information@sherpasoftware.com
More informationSECURITY RISK MANAGEMENT
SECURITY RISK MANAGEMENT ISACA Atlanta Chapter, Geek Week August 20, 2013 Scott Ritchie, Manager, HA&W Information Assurance Services Scott Ritchie CISSP, CISA, PCI QSA, ISO 27001 Auditor Manager, HA&W
More informationInformation Technology Services Project Management Office Operations Guide
Information Technology Services Project Management Office Operations Guide Revised 3/31/2015 Table of Contents ABOUT US... 4 WORKFLOW... 5 PROJECT LIFECYCLE... 6 PROJECT INITIATION... 6 PROJECT PLANNING...
More informationFINAL Version 1.0 June 25, 2014
CENTERS for MEDICARE & MEDICAID SERVICES Enterprise Information Security Group 7500 Security Boulevard Baltimore, Maryland 21244-1850 Risk Management Handbook Volume III Standard 7.2 FINAL Version 1.0
More informationAchieving Security through Compliance
White Paper Achieving Security through Compliance Policies, plans, and procedures Part I By Jeff Tucker, Principal Security Consultant McAfee Foundstone Professional Services Table of Contents Overview
More informationNASA Information Technology Requirement
NASA Information Technology Requirement NITR-2800-2 Effective Date: September 18,2009 Expiration Date: September 18, 2013 Email Services and Email Forwarding Responsible Office: OCIO/ Chief Information
More information014-00-01-01-01-1146-00. Mixed Life Cycle FY2002
Consolidated American System (CAPPS) and Interagency e Migration Exhibit 300: Part I: Summary Information and Justification (All Capital Assets) I.A. Overview 1. Date of Submission: 2. Agency: Department
More informationFinal Audit Report FEDERAL INFORMATION SECURITY MANAGEMENT ACT AUDIT FY 2012. Report No. 4A-CI-00-12-016
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Subject: FEDERAL INFORMATION SECURITY MANAGEMENT ACT AUDIT FY 2012 Report No. 4A-CI-00-12-016 Date:
More informationDodging Breaches from Dodgy Vendors: Tackling Vendor Risk Management in Healthcare
Dodging Breaches from Dodgy Vendors: Tackling Vendor Risk Management in Healthcare Strengthening Cybersecurity Defenders #ISC2Congress Healthcare and Security "Information Security is simply a personal
More informationServer Management-Scans & Patches
THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES Server Management-Scans & Patches Report No. 14-11 OFFICE OF INTERNAL AUDITS THE UNIVERSITY OF TEXAS - PAN AMERICAN 1201 West
More informationMICHIGAN AUDIT REPORT OFFICE OF THE AUDITOR GENERAL THOMAS H. MCTAVISH, C.P.A. AUDITOR GENERAL
MICHIGAN OFFICE OF THE AUDITOR GENERAL AUDIT REPORT THOMAS H. MCTAVISH, C.P.A. AUDITOR GENERAL The auditor general shall conduct post audits of financial transactions and accounts of the state and of all
More informationFiscal Year 2007 Federal Information Security Management Act Report
OFFICE OF INSPECTOR GENERAL Special Report Catalyst for Improving the Environment Fiscal Year 2007 Federal Information Security Management Act Report Status of EPA s Computer Security Program Report No.
More informationInformation Security. Rick Aldrich, JD, CISSP Booz Allen Hamilton Aldrich_Richard@bah.com
Information Security Rick Aldrich, JD, CISSP Booz Allen Hamilton Aldrich_Richard@bah.com Overview (Fed Info Sys) From NIST SP 800-60, Vol 1, Guide for Mapping Types of Information Systems to Security Categories
More informationFiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Information Technology Fiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program Report.
More informationCritical Controls for Cyber Security. www.infogistic.com
Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability
More informationHHS Information System Security Controls Catalog V 1.0
Information System Security s Catalog V 1.0 Table of Contents DOCUMENT HISTORY... 3 1. Purpose... 4 2. Security s Scope... 4 3. Security s Compliance... 4 4. Security s Catalog Ownership... 4 5. Security
More informationNEIAF June 18, 2015. IS Auditing 101
NEIAF June 18, 2015 IS Auditing 101 http://www.gao.gov/fiscam/overview Planning Understand the Overall Audit Objectives and Related Scope of the Information System Controls Audit Understand the Entity
More informationFedRAMP Standard Contract Language
FedRAMP Standard Contract Language FedRAMP has developed a security contract clause template to assist federal agencies in procuring cloud-based services. This template should be reviewed by a Federal
More informationSection 37.1 Purpose... 1. Section 37.2 Background... 3. Section 37.3 Scope and Applicability... 4. Section 37.4 Policy... 5
CIOP CHAPTER 37 Departmental Cybersecurity Policy TABLE OF CONTENTS Section 37.1 Purpose... 1 Section 37.2 Background... 3 Section 37.3 Scope and Applicability... 4 Section 37.4 Policy... 5 Section 37.5
More informationNATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL FY 2015 INDEPENDENT EVALUATION OF THE EFFECTIVENESS OF NCUA S INFORMATION SECURITY PROGRAM UNDER THE FEDERAL INFORMATION SECURITY MODERNIZATION
More informationOffice of the CIO. Department Description. Goals and Objectives
Department Description The Office of the Chief Information Officer (OCIO) is comprised of the Communications and Information Technology (IT) divisions. The Communications Division provides all wireless
More informationEPA Classification No.: CIO-2150.3-P-09.1 CIO Approval Date: 08/06/2012 CIO Transmittal No.: 12-003 Review Date: 08/06/2015
Issued by the EPA Chief Information Officer, Pursuant to Delegation 1-19, dated 07/07/2005 INFORMATION SECURITY INTERIM MAINTENANCE PROCEDURES V1.8 JULY 18, 2012 1. PURPOSE The purpose of this procedure
More informationFREQUENTLY ASKED QUESTIONS
FREQUENTLY ASKED QUESTIONS Continuous Monitoring 1. What is continuous monitoring? Continuous monitoring is one of six steps in the Risk Management Framework (RMF) described in NIST Special Publication
More informationDIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Threat and Vulnerability Management V1.0 April 21, 2014
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Threat and Vulnerability Management V1.0 April 21, 2014 Revision History Update this table every time a new edition of the document is
More informationPersonal Security Practices of the CAO
Personal Security Practices of the CAO 1. Do you forward your government email to your personal email account? 2. When is the last time you changed your Enterprise password? Within the last 60 days Within
More informationSecurity Controls Assessment for Federal Information Systems
Security Controls Assessment for Federal Information Systems Census Software Process Improvement Program September 11, 2008 Kevin Stine Computer Security Division National Institute of Standards and Technology
More informationTREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION Treasury Inspector General for Tax Administration Federal Information Security Management Act Report October 27, 2009 Reference Number: 2010-20-004 This
More informationNOTICE: This publication is available at: http://www.nws.noaa.gov/directives/.
Department of Commerce National Oceanic & Atmospheric Administration National Weather Service NATIONAL WEATHER SERVICE Instruction 60-701 28 May 2012 Information Technology IT Security Assignment of Responsibilities
More informationThe Intersection of Internal Controls and Cyber Security
The Intersection of Internal Controls and Cyber Security Ralph Mosios Chief Information Security Officer Federal Housing Finance Agency ISACA NCAC Conference November 18, 2014 The Federal Housing Finance
More informationSecurity Management Practices. Keith A. Watson, CISSP CERIAS
Security Management Practices Keith A. Watson, CISSP CERIAS Overview The CIA Security Governance Policies, Procedures, etc. Organizational Structures Roles and Responsibilities Information Classification
More informationCORL Dodging Breaches from Dodgy Vendors
CORL Dodging Breaches from Dodgy Vendors Tackling Vendor Security Risk Management in Healthcare Introductions Cliff Baker 20 Years of Healthcare Security experience PricewaterhouseCoopers, HITRUST, Meditology
More informationINFORMATION TECHNOLOGY PROJECT REQUESTS
INFORMATION TECHNOLOGY PROJECT REQUESTS Guidelines & Instructions for Maryland State Agencies Revised Two Step PPR/PIR Approval Process Fiscal Year 2013 Table of Contents Part 1: Overview... 2 1.1 Introduction...
More information9. Did the Agency's Executive/Investment Committee approve this request?
Electronic Medical Record (EMR) Exhibit 300: Part I: Summary and Justification (All Capital s) I.A. Overview 1. Date of Submission: 2. Agency: Department of State 3. Bureau: M/MED Medical Director 4. Name
More informationRisk Management Framework (RMF): The Future of DoD Cyber Security is Here
Risk Management Framework (RMF): The Future of DoD Cyber Security is Here Authors: Rebecca Onuskanich William Peterson 3300 N Fairfax Drive, Suite 308 Arlington, VA 22201 Phone: 571-481-9300 Fax: 202-315-3003
More informationAUDIT REPORT. The Energy Information Administration s Information Technology Program
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections AUDIT REPORT The Energy Information Administration s Information Technology Program DOE-OIG-16-04 November 2015 Department
More informationBuilding Security In:
#CACyberSS2015 Building Security In: Intelligent Security Design, Development and Acquisition Steve Caimi Industry Solutions Specialist, US Public Sector Cybersecurity September 2015 A Little About Me
More informationState of Oregon. State of Oregon 1
State of Oregon State of Oregon 1 Table of Contents 1. Introduction...1 2. Information Asset Management...2 3. Communication Operations...7 3.3 Workstation Management... 7 3.9 Log management... 11 4. Information
More informationGuideline for Mapping Types of Information and Information Systems to Security Categorization Levels SP 800-60 AP-2/03-1
Guideline for Mapping Types of Information and Information Systems to Security Categorization Levels SP 800-60 FISMA Legislation Overview (Public Law 107-347) Framework for ensuring effectiveness of Federal
More informationGuide for the Role and Responsibilities of an Information Security Officer Within State Government
Guide for the Role and Responsibilities of an Information Security Officer Within State Government Table of Contents Introduction 3 The ISO in State Government 4 Successful ISOs Necessary Skills and Abilities
More informationPaisley Enterprise GRC Audit Profile. Linda Bergs
Paisley Enterprise GRC Audit Profile Linda Bergs Successful Implementation Champion Buy-in Budget Technology Who We Are Paisley is an independent software vendor providing innovative solutions for governance,
More informationInformation Security for Managers
Fiscal Year 2015 Information Security for Managers Introduction Information Security Overview Enterprise Performance Life Cycle Enterprise Performance Life Cycle and the Risk Management Framework Categorize
More informationBriefing Report: Improvements Needed in EPA s Information Security Program
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Briefing Report: Improvements Needed in EPA s Information Security Program Report No. 13-P-0257 May 13, 2013 Scan this mobile code to learn
More informationFSIS DIRECTIVE 1306.3
UNITED STATES DEPARTMENT OF AGRICULTURE FOOD SAFETY AND INSPECTION SERVICE WASHINGTON, DC FSIS DIRECTIVE 1306.3 REVISION 1 12/13/12 CONFIGURATION MANAGEMENT (CM) OF SECURITY CONTROLS FOR INFORMATION SYSTEMS
More informationOffice of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
More informationDRAFT Publication 4812 State of Security (SoS) Package
DRAFT Publication 4812 State of Security (SoS) Package Contractor Security Controls Handling and Protecting Information or Information Systems ***This Package Pertains to IT Assets Owned and Managed at
More informationState of South Carolina Policy Guidance and Training
DRAFT For Discussion Purposes Only State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Information Systems (IS) Acquisitions, Development, and Maintenance Policy April/May
More informationIBM Internet Security Systems October 2007. FISMA Compliance A Holistic Approach to FISMA and Information Security
IBM Internet Security Systems October 2007 FISMA Compliance A Holistic Approach to FISMA and Information Security Page 1 Contents 1 Executive Summary 1 FISMA Overview 3 Agency Challenges 4 The IBM ISS
More informationEvaluation of DHS' Information Security Program for Fiscal Year 2014
Evaluation of DHS' Information Security Program for Fiscal Year 2014 December 12, 2014 HIGHLIGHTS Evaluation of DHS Information Security Program for Fiscal Year 2014 December 12, 2014 Why We Did This We
More informationPDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name]
PDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name] [Date] [Location] 1 Prepared by: [Author] [Title] Date Approved by: [Name] [Title] Date 2
More informationHEALTH INSURANCE MARKETPLACES GENERALLY PROTECTED PERSONALLY IDENTIFIABLE INFORMATION BUT COULD IMPROVE CERTAIN INFORMATION SECURITY CONTROLS
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL HEALTH INSURANCE MARKETPLACES GENERALLY PROTECTED PERSONALLY IDENTIFIABLE INFORMATION BUT COULD IMPROVE CERTAIN INFORMATION SECURITY
More informationCyber Security Operations Center (CSOC) for Critical Infrastructure Protection
SESSION ID: CXO-F02 Cyber Security Operations Center (CSOC) for Critical Infrastructure Protection Timothy Lee CISO City of Los Angeles @tswlj316 AGENDA Introduction Why do we need Cyber Security Operations
More informationA Flexible and Comprehensive Approach to a Cloud Compliance Program
A Flexible and Comprehensive Approach to a Cloud Compliance Program Stuart Aston Microsoft UK Session ID: SPO-201 Session Classification: General Interest Compliance in the cloud Transparency Responsibility
More informationISSA SILICON VALLEY SECURITY METRICS SO WHAT?
ISSA SILICON VALLEY SECURITY METRICS SO WHAT? WILLIAM TANG, CTO MARCH 10, 2010 ALLGRESS, INC. 2009 ALLGRESS, INC. 1 Security Metrics So What? Why are we gathering metrics? Who are we gathering these metrics
More informationCapability Statement (Organizational)
Capability Statement (Organizational) Aspiryon, LLC. Email:info@aspiryon.net Web: www.aspiryon.net Summary of Services Aspiryon has been an award-winning provider of strategic staffing, technology and
More informationAudit of the Board s Information Security Program
Board of Governors of the Federal Reserve System Audit of the Board s Information Security Program Office of Inspector General November 2011 November 14, 2011 Board of Governors of the Federal Reserve
More informationCapabilities Overview
Premier Provider of egov Services to the Commonwealth of Virginia Capabilities Overview May 2015 Your One Stop Shop for egov Services CAI ITCL Statement of Work Contract Application Development VITA egov
More informationVulnerability Management. Information Technology Audit. For the Period July 2010 to July 2011
O L A OFFICE OF THE LEGISLATIVE AUDITOR STATE OF MINNESOTA FINANCIAL AUDIT DIVISION REPORT Vulnerability Management Information Technology Audit For the Period July 2010 to July 2011 May 22, 2012 Report
More informationSample marketing plan template
Sample marketing plan template Table of Contents 1) Executive summary Page # 2) Situation analysis Page # 3) Marketing strategy Page # 4) Financials Page # 5) Implementation and Contingency Page # http://www.entrepreneurmag.co.za/
More informationState of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agency IT Risk Strategy June 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy Overview: IT Risk Strategy
More informationAn Overview of Information Security Frameworks. Presented to TIF September 25, 2013
An Overview of Information Security Frameworks Presented to TIF September 25, 2013 What is a framework? A framework helps define an approach to implementing, maintaining, monitoring, and improving information
More informationOffice of the Auditor General Performance Audit Report. Statewide Oracle Database Controls Department of Technology, Management, and Budget
Office of the Auditor General Performance Audit Report Statewide Oracle Database Controls Department of Technology, Management, and Budget March 2015 071-0565-14 State of Michigan Auditor General Doug
More informationApples to Oranges: SAP s License Administration Workbench (LAW) is NOT a Software Asset Management or License Optimization Solution!
Apples to Oranges: SAP s License Administration Workbench (LAW) is NOT a Software Asset Management or License Optimization Solution! Page 2 Introduction SAP s LAW (License Administration Workbench) tool
More informationIndependent Security Operations Oversight and Assessment. Captain Timothy Holland PM NGEN
Independent Security Operations Oversight and Assessment Captain Timothy Holland PM NGEN 23 June 2010 Independent Security Operations Oversight and Assessment Will Jordan NGEN Cyber Security 23 June 2010
More informationReview of the SEC s Systems Certification and Accreditation Process
Review of the SEC s Systems Certification and Accreditation Process March 27, 2013 Page i Should you have any questions regarding this report, please do not hesitate to contact me. We appreciate the courtesy
More informationPREFACE TO SELECTED INFORMATION DIRECTIVES CHIEF INFORMATION OFFICER MEMORANDUM
PREFACE TO SELECTED INFORMATION DIRECTIVES CIO Transmittal No.: 15-010 CIO Approval Date: 06/12/2015 Issued by the EPA Chief Information Officer, Pursuant to Delegation 1-19, dated 07/07/2005 CHIEF INFORMATION
More informationOCCUPATIONAL GROUP: Information Technology. CLASS FAMILY: Security CLASS FAMILY DESCRIPTION:
OCCUPATIONAL GROUP: Information Technology CLASS FAMILY: Security CLASS FAMILY DESCRIPTION: This family of positions provides security and monitoring for the transmission of information in voice, data,
More informationU.S. CONSUMER PRODUCT SAFTEY COMMISSION OFFICE OF INSPECTOR GENERAL FY 2015 FEDERAL INFORMATION SECURITY MANAGEMENT ACT REVIEW REPORT
U.S. CONSUMER PRODUCT SAFTEY COMMISSION OFFICE OF INSPECTOR GENERAL FY 2015 FEDERAL INFORMATION SECURITY MANAGEMENT ACT REVIEW REPORT Issued: 12/8/2015 This report conveys the results of the OIG s review
More informationMASSACHUSETTS GAMING COMMISSION: CHIEF INFORMATION OFFICER JOB DESCRIPTION
MASSACHUSETTS GAMING COMMISSION: CHIEF INFORMATION OFFICER JOB DESCRIPTION The Massachusetts Gaming Commission invites applications for the position of Chief Information Officer. The Commission is a new
More informationFISH AND WILDLIFE SERVICE INFORMATION RESOURCES MANAGEMENT. Chapter 7 Information Technology (IT) Security Program 270 FW 7 TABLE OF CONTENTS
TABLE OF CONTENTS General Topics Purpose and Authorities Roles and Responsibilities Policy and Program Waiver Process Contact Abbreviated Sections/Questions 7.1 What is the purpose of this chapter? 7.2
More informationU.S. Department of Energy Office of Inspector General Office of Audits and Inspections
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report The Department's Configuration Management of Non-Financial Systems OAS-M-12-02 February 2012 Department
More informationU.S. Department of Energy Office of Inspector General Office of Audits & Inspections
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections Audit Report Management of Western Area Power Administration's Cyber Security Program DOE/IG-0873 October 2012 Department
More informationInformation System Security Officer (ISSO) Guide
Information System Security Officer (ISSO) Guide Office of the Chief Information Security Officer Version 10 September 16, 2013 DEPARTMENT OF HOMELAND SECURITY Document Change History INFORMATION SYSTEM
More informationDepartment of Veterans Affairs VA Handbook 6500. Information Security Program
Department of Veterans Affairs VA Handbook 6500 Washington, DC 20420 Transmittal Sheet September 18, 2007 Information Security Program 1. REASON FOR ISSUE: To provide specific procedures and establish
More informationEnterprise Architecture Glossary by Set
Set: Enterprise Architecture (EA) Glossary Term Source Enterprise architecture terms based on NASCIO,, and other industry best practices. Description Albers Equal Area Projection egsc.usgs.gov A projection
More informationHARPER, RAINS, KNIGHT & COMPANY, P.A. CERTIFIED PUBLIC ACCOUNTANTS & CONSULTANTS RIDGELAND, MISSISSIPPI
FARM CREDIT ADMINISTRATION OFFICE OF INSPECTOR GENERAL FEDERAL INFORMATION SECURITY MANAGEMENT ACT OF 2002 EVALUATION For the Fiscal Year Ending September 30, 2007 HARPER, RAINS, KNIGHT & COMPANY, P.A.
More informationInternal Control Evaluation Progress Report for Frisco Independent School District. March 7, 2011
Internal Control Evaluation Progress Report for Frisco Independent School District March 7, 2011 Topics 2010 Internal Control Evaluation Activities - Phases III and IV 2010 Actual Hours and Fees Phases
More information