Cyber Security Walk-Through Procedure
|
|
|
- Victor Davidson
- 8 years ago
- Views:
Transcription
1 Page 1 of 7 Review Date Cyber Security Walk-Through Procedure This procedure provides a description of the Cyber Security Walk-Through program of the Ames Laboratory, as required by the Ames Laboratory Cyber Security Program Plan. Comments and questions regarding this procedure should be directed to the contact person listed below: Name: William Sears Cyber Security Manager Address: 334 TASF Phone: Sign-off Record: Reviewed by: William Sears, Cyber Security Manager Dianne DenAdel, Manager, Information Systems Tom E. Wessels, Manager, Environment, Safety, Health, and Assurance Mark Murphy, Chief Operations Officer Dr. Bruce Harmon, Deputy Director Note: Original Sign-off Record with signatures is on file with ESH&A
2 Page 2 of 7 Review Date Revision/Review Log This document will be reviewed once every two (2) years as a minimum. Revision Effective Contact Pages Description of Revision Number Date Person Affected 0 11/1/2007 C. Strasburg All Initial Issue 1 4/16/2007 C. Strasburg 7 See Revision Description Document 2 2/25/2010 B. Sears 1,2,3 See Revision Description Document 2.0 Purpose and Scope The Laboratory's policy for Cyber Security Walk-Throughs is documented in Section CM-6 of the Ames Laboratory Low Security Controls Baseline. The Walk-Through program is an integral part of the Ames Laboratory Integrated Safeguards and Security Management (ISSM) System (Plan ) and the Ames Laboratory Oversight and Assurance Program (Plan ). A Walk-Through is a planned tour of a Department/Program or area on a routine, scheduled basis, with a specific focus applicable to that Department/Program. The Laboratory's Cyber Security Walk-Through program is designed to provide a mechanism for personal observation and evaluation of the Laboratory's cyber security implementation by management and specialists. It is a look at specific attributes of cyber security against requirements promulgated by the Laboratory, DOE, and other governmental organizations. The Walk- Through process is not intended to produce administrative burden or place unrealistic expectations on managers. However, deficiencies noted will be recorded, analyzed, tracked, and resolved. 3.0 Prerequisite Actions and Requirements The members of the Walk-Through team have adequate technical understanding of the special requirements and policies they will be assessing against. Also, the Walk-Through team will have an understanding of this Cyber Security Walk-Through procedure and receive orientation to effectively conduct their assigned Walk-Through functions. 4.0 Performance 4.1 Prior Notification The Cyber Security Manager shall schedule the Cyber Security Walk-Throughs. The Program Director/Department Manager and the Assistant Computer Protection Manager shall be notified in writing two weeks prior to the performance of the Walk-Through. Notification shall include a general definition of the scope of the Walk-Through and a brief description of the Walk-Through process.
3 Page 3 of 7 Review Date Walk-Through Team Members and Specialties The Cyber Security Walk-Through Team will involve one cyber security representative to answer questions and discuss cyber security policies and procedures, and another representative to perform system checks and work with the Assistant Computer Program Manager (ACPM) for that program on implementation. 4.3 Walk-Through Process The Walk-Through process will be conducted according to the following guidelines Pre Walk-Through Process A meeting is conducted with department managers, program directors, and ACPMs. Participants are briefed by the Walk-Through Team of what will be evaluated and any potential emphasis that may be assessed according to new regulations (DOE, NIST, OMB, etc.). A pre-walk-through checklist (Form , Pre-Walk-Through Meeting ) details the topics covered and is submitted following this activity. A system inventory based on network registration data is provided to the ACPM to ensure that central inventory data is up to date. After corrections are made, machines are selected for review using the following criteria in order of preference: 1. Systems with recent compliance problems, or for which central monitoring has detected problems with the configuration. 2. Systems which have been recently registered on the network. 3. A random selection of remaining systems to ensure that a sufficient number are reviewed Walk-Through Process When recording notes, observers will tell representatives what they have observed and are writing for report purposes. If observers do not understand the computer system s condition or function, they should ask a supervisor or employee for a briefing of the present security controls. Observers should move steadily through the program or department area. If conditions warrant, they will announce that they need to return for a more in-depth appraisal of the computer systems. Of the scheduled time, observers will allow about seventy percent for looking at the selected systems, about twenty five percent for wandering around and asking general questions about computer security implementation, and about five percent for a post observation Walk- Through conference. Observers will record conditions as concerns or noteworthy practices during the Walk- Through Post Walk-Through Process Concerns and noteworthy practices will be submitted to the Cyber Security Manager for the final report, tracking, and screening for event reporting.
4 Page 4 of 7 Review Date Post Walk-Through Conference The conditions noted during the Walk-Through will be reviewed with the Program Director/Department Manager, Assistant Computer Protection Manager, and other interested members of the Program/Department at the end of the Walk-Through or at a mutually agreed upon time. This conference will provide an opportunity to discuss appropriate corrective actions. 4.5 Walk-Through Report The written Walk-Through report shall be prepared within two weeks and sent to: Deputy Director Chief Operations Officer Program Director ESHA Manager Information Systems Manager Assistant Computer Protection Managers Group Administrators The report shall include: Identification of the individual(s) who conducted the Walk-Through A listing of areas and systems reviewed A record of the cyber security conditions observed including Findings, Noteworthy Practices and Strengths Planned corrective actions Concerns are categorized by the following for Laboratory wide trend analysis. 1. Adherence to baseline system configurations 2. Effectiveness of user account management procedures 3. Effectiveness of system inventory practices 5.0 Post Performance Activity 5.1 Closeout of Walk-Through Observations There are three broad observation categories used during the Walk-Through process: Noteworthy Practices, Strengths, and Findings. Noteworthy Practice A positive observation, based on objective assessment data, of a particular practice, procedure, process, or system considered so unique or innovative enough that the entire Laboratory might find it beneficial. Mere compliance with mandatory requirements is not considered to be a noteworthy practice. Examples include: implementing an encrypted backup system with off-site media rotation, automated detection, notification, and disabling of idle user accounts, or directly providing cyber security alerts or training to users in the program.
5 Page 5 of 7 Review Date Strength A mature process or activity that has consistently demonstrated the ability to meet expectations, or a process or activity that efficiently and effectively facilitates and integrates processes, activities, and resources. Examples include: removing all local user accounts from systems, all users operating without administrative privileges, or maintaining a fully up-to-date system inventory. Finding A finding is a determination of deficiency pertaining to implementation of a requirement based on a recognized inadequacy or weakness. Findings are categorized as levels 1, 2, or 3. This categorization is necessary to identify the degree of management formality and rigor required for the correction, tracking to closure, and trending of findings. Level 1 Finding: Determinations of deficiency of major significance that warrant a high level of attention on the part of line management. Typically these reflect a gap in addressing requirements or a systemic problem at implementing requirements. If left uncorrected, this level of finding could negatively impact the SC mission. Examples include: inadequate network access controls, wide-spread lack of security policy settings, or systemic failure to apply patches in a timely fashion. Level 2 Finding: Determinations of deficiency that represent a non-conformance and/or deviation with implementation of a requirement. Multiple determinations of deficiency at this level, when of a similar nature, may be rolled-up together into one or more Level 1 Findings. Level 2 findings can be further qualified by noting the significance of the issue. High significance issues: Conditions that are an immediate threat to the security of Ames Laboratory s computing environment, could cause severe or permanent data loss, or have potential for significant programmatic impact, such as: user accounts with a blank password, lack of an antivirus program, or systems missing updates. Moderate significance issues: Conditions that could cause minor or temporary loss in data confidentiality, integrity, or availability, or have potential for minor programmatic impact, such as: users running with unnecessary administrative privileges, failure to meet all baseline security recommendations, using local accounts as opposed to domain accounts. Level 3 Finding: Determinations of deficiency where it is recognized that improvements can be gained in process, performance, or efficiency already established for meeting a requirement. This level of finding should also include minor deviations observed during oversight activities that can be promptly corrected and verified as completed. Examples include: unused accounts which have not been disabled on a system, lack of a structured system inventory maintenance plan, or screensaver duration set too long. Documentation of findings should include the statement of the specific requirement (e.g. Laboratory
6 Page 6 of 7 Review Date policy, control source, etc.), the description of the programmatic breakdown (if applicable), and objective evidence demonstrating the deficiency. It is the responsibility of the Program/Department to perform the actions necessary to closeout the concerns identified during the Walk-Through according to the requirements for the Finding level assigned to the observation. This includes requesting assistance or desktop support from Information Systems to perform maintenance/service. The following is the time schedule for closing out the QA discrepancies: Level 1 Findings A corrective action plan will be developed and a Plan of Action and Milestones entry will be submitted to track corrective action progress. The plan will be developed and submitted within 30 days of report date. The plan will be completed within 1 year of the report date. Verification is performed by the Chief Operations Officer (COO). Level 2 High Significance Findings Close out by the end of the first full workday after the concerns are identified, or develop a corrective action plan for closeout which must be approved by the CPPM or the COO. Verification is performed by the CPPM. Level 2 Moderate Significance Findings Close out within 60 days of report date or develop corrective action plan for close out which must be approved by the CPPM or COO. Verification is performed by the CPPM. Level 3 Findings Close out as soon a possible, as resources are available. Verification is performed by the area ACPM. 5.2 Lessons Learned Lessons Learned Reports will be prepared for feedback and continuous improvement as a result of observations identified during the Walk-Through process. 5.3 Annual Trend Analysis of Cyber Security Concerns Statistics are generated annually by Cyber Security staff based on the Walk-Through observations and quarterly cyber status reports. This information will be communicated to the Executive Council through an annual report. 5.4 Disposition of Records Walk-Through records will be maintained by the Information Systems office.
7 Page 7 of 7 Review Date Appendix A Tentative Program Review Schedule January February March April May June July August September October November December Condensed Matter Physics (CMP) Materials and Engineering Physics (MEP) Applied Math and Computational Sciences (SCL) Center for Sustainable Environmental Technologies (CSET) Chemical and Biological Sciences Administrative Services No Walk-Through Year End Environmental and Protection Sciences (EPSCI/MFRC) Information Systems and ESH&A Materials Chemistry (MatChem)
AUDIT REPORT. Cybersecurity Controls Over a Major National Nuclear Security Administration Information System
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections AUDIT REPORT Cybersecurity Controls Over a Major National Nuclear Security Administration Information System DOE/IG-0938
Evaluation Report. Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review. April 30, 2014 Report Number 14-12
Evaluation Report Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review April 30, 2014 Report Number 14-12 U.S. Small Business Administration Office of Inspector General
EVALUATION REPORT. Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review. March 13, 2015 REPORT NUMBER 15-07
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
Internal Controls And Good Utility Practices. Ruchi Ankleshwaria Manager, Compliance Risk Analysis
Internal Controls And Good Utility Practices Ruchi Ankleshwaria Manager, Compliance Risk Analysis 2 Introduction Joined WECC in March 2013 6 years of industry experience prior to joining WECC 4 years at
SMITHSONIAN INSTITUTION
SMITHSONIAN INSTITUTION FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) 2012 INDEPENDENT EVALUATION REPORT TABLE OF CONTENTS PURPOSE 1 BACKGROUND 1 OBJECTIVES, SCOPE, AND METHODOLOGY 2 SUMMARY OF RESULTS
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report The Department's Configuration Management of Non-Financial Systems OAS-M-12-02 February 2012 Department
Automated Office Systems Support Quality Assurance Plan. A Model DRAFT. December 1996
Quality Assurance Plan A Model DRAFT United States Department of Energy Office of Nonproliferation and National Security Title Page Document Name: Publication Date: Draft, ontract Number: Project Number:
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections. Evaluation Report
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Evaluation Report The Department's Unclassified Cyber Security Program 2011 DOE/IG-0856 October 2011 Department of
Office of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
Office of the Auditor General Performance Audit Report. Statewide Oracle Database Controls Department of Technology, Management, and Budget
Office of the Auditor General Performance Audit Report Statewide Oracle Database Controls Department of Technology, Management, and Budget March 2015 071-0565-14 State of Michigan Auditor General Doug
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report Management of Los Alamos National Laboratory's Cyber Security Program DOE/IG-0880 February 2013 Department
Introduction. PCI DSS Overview
Introduction Manage Engine Desktop Central is part of ManageEngine family that represents entire IT infrastructure with products such as Network monitoring, Helpdesk management, Application management,
Information Security for Managers
Fiscal Year 2015 Information Security for Managers Introduction Information Security Overview Enterprise Performance Life Cycle Enterprise Performance Life Cycle and the Risk Management Framework Categorize
Report of Evaluation OFFICE OF INSPECTOR GENERAL. OIG 2014 Evaluation of the Farm Credit OIG 2014 Administration s. Management Act.
OFFICE OF INSPECTOR GENERAL Report of Evaluation OIG 2014 Evaluation of the Farm Credit OIG 2014 Administration s Evaluation of the Farm Compliance Credit Administration s with the Federal Information
Audit of the Board s Information Security Program
Board of Governors of the Federal Reserve System Audit of the Board s Information Security Program Office of Inspector General November 2011 November 14, 2011 Board of Governors of the Federal Reserve
Security Control Standard
Department of the Interior Security Control Standard Risk Assessment January 2012 Version: 1.2 Signature Approval Page Designated Official Bernard J. Mazer, Department of the Interior, Chief Information
Privacy Impact Assessment (PIA) for the. Certification & Accreditation (C&A) Web (SBU)
Privacy Impact Assessment (PIA) for the Cyber Security Assessment and Management (CSAM) Certification & Accreditation (C&A) Web (SBU) Department of Justice Information Technology Security Staff (ITSS)
Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis
Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University
In Brief. Smithsonian Institution Office of the Inspector General. Smithsonian Institution Information Security Program
Smithsonian Institution Office of the Inspector General Smithsonian Institution In Brief Report Number A-11-05, May 15, 2012 Why We Did This Audit The Federal Information Security Management Act of 2002
Audit Report. Management of Naval Reactors' Cyber Security Program
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report Management of Naval Reactors' Cyber Security Program DOE/IG-0884 April 2013 Department of Energy Washington,
Cyber Security Incident Handling Policy. Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology
Cyber Security Incident Handling Policy Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology Date: Oct 9, 2015 i Document Control Document Owner Classification
VA Office of Inspector General
VA Office of Inspector General OFFICE OF AUDITS & EVALUATIONS Department of Veterans Affairs Federal Information Security Management Act Audit for Fiscal Year 2013 May 29, 2014 13-01391-72 ACRONYMS AND
Report of Evaluation OFFICE OF INSPECTOR GENERAL E-09-01. Tammy Rapp Auditor-in-Charge FARM CREDIT ADMINISTRATION
OFFICE OF INSPECTOR GENERAL Report of Evaluation OIG 2009 Evaluation of the Farm Credit Administration s Compliance with the Federal Information Security Management Act E-09-01 November 18, 2009 Tammy
Security Control Standard
Department of the Interior Security Control Standard Security Assessment and Authorization January 2012 Version: 1.2 Signature Approval Page Designated Official Bernard J. Mazer, Department of the Interior,
FISH AND WILDLIFE SERVICE INFORMATION RESOURCES MANAGEMENT. Chapter 7 Information Technology (IT) Security Program 270 FW 7 TABLE OF CONTENTS
TABLE OF CONTENTS General Topics Purpose and Authorities Roles and Responsibilities Policy and Program Waiver Process Contact Abbreviated Sections/Questions 7.1 What is the purpose of this chapter? 7.2
PHASE 9: OPERATIONS AND MAINTENANCE PHASE
PHASE 9: OPERATIONS AND MAINTENANCE PHASE During the Operations and Maintenance Phase, the information system s availability and performance in executing the work for which it was designed is maintained.
Cybersecurity Risk Management Activities Instructions Fiscal Year 2015
Cybersecurity Risk Management Activities Instructions Fiscal Year 2015 An effective risk management program and compliance with the Federal Information Security Management Act (FISMA) requires the U.S.
This interpretation of the revised Annex
Reprinted from PHARMACEUTICAL ENGINEERING The Official Magazine of ISPE July/August 2011, Vol. 31 No. 4 www.ispe.org Copyright ISPE 2011 The ISPE GAMP Community of Practice (COP) provides its interpretation
Security Tool Kit System Checklist Departmental Servers and Enterprise Systems
Security Tool Kit System Checklist Departmental Servers and Enterprise Systems INSTRUCTIONS System documentation specifically related to security controls of departmental servers and enterprise systems
FSIS DIRECTIVE 1306.3
UNITED STATES DEPARTMENT OF AGRICULTURE FOOD SAFETY AND INSPECTION SERVICE WASHINGTON, DC FSIS DIRECTIVE 1306.3 REVISION 1 12/13/12 CONFIGURATION MANAGEMENT (CM) OF SECURITY CONTROLS FOR INFORMATION SYSTEMS
Peer Review Process Description
Peer Review Process Description Version 1.0 draft1 Table of Contents 1. Overview... 1 2. Work Aids... 1 3. Risk Assessment Guidance... 1 4. Participants... 2 5. Inspection
OFFICIAL USE ONLY. Department of Energy. DATE: January 31, 2007 Audit Report Number: OAS-L-07-06
DOE F 1325.8 (08-93) United States Government Memorandum Department of Energy DATE: January 31, 2007 Audit Report Number: OAS-L-07-06 REPLY TO ATTN OF: SUBJECT: TO: IG-34 (A06TG041) Evaluation of the "Office
Management (CSM) Capability
CDM Configuration Settings Management (CSM) Capability Department of Homeland Security National Cyber Security Division Federal Network Security Network & Infrastructure Security Table of Contents 1 PURPOSE
STATE OF ARIZONA Department of Revenue
STATE OF ARIZONA Department of Revenue Douglas A. Ducey Governor September 25, 2015 David Raber Director Debra K. Davenport, CPA Auditor General Office of the Auditor General 2910 North 44 th Street, Suite
Cybersecurity Health Check At A Glance
This cybersecurity health check provides a quick view of compliance gaps and is not intended to replace a professional HIPAA Security Risk Analysis. Failing to have more than five security measures not
NETWORK INFRASTRUCTURE USE
NETWORK INFRASTRUCTURE USE Information Technology Responsible Office: Information Security Office http://ooc.usc.edu infosec@usc.edu (213) 743-4900 1.0 Purpose The (USC) provides its faculty, staff and
Fiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Information Technology Fiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program Report.
Appendix 10 IT Security Implementation Guide. For. Information Management and Communication Support (IMCS)
Appendix 10 IT Security Implementation Guide For Information Management and Communication Support (IMCS) 10.1 Security Awareness Training As defined in NPR 2810.1A, all contractor personnel with access
Report No. D-2010-058 May 14, 2010. Selected Controls for Information Assurance at the Defense Threat Reduction Agency
Report No. D-2010-058 May 14, 2010 Selected Controls for Information Assurance at the Defense Threat Reduction Agency Additional Copies To obtain additional copies of this report, visit the Web site of
Server Security Checklist (2009 Standard)
Server Security Checklist (2009 Standard) Server identification and location: Completed by (please print): Date: Signature: Manager s signature: Next scheduled review date: Date: Secure Network and Physical
Peer Review Process Description
Peer Review Process Description Version 1.0 draft1 Table of Contents 1.Overview...1 2.Work Aids...1 3.Risk Assessment Guidance...1 4.Participants...2 5.Inspection Procedure...4
North American Electric Reliability Corporation: Critical Infrastructure Protection, Version 5 (NERC-CIP V5)
Whitepaper North American Electric Reliability Corporation: Critical Infrastructure Protection, Version 5 (NERC-CIP V5) NERC-CIP Overview The North American Electric Reliability Corporation (NERC) is a
DOE O 226.1A, IMPLEMENTATION OF DEPARTMENT OF ENERGY OVERSIGHT POLICY CONTRACTOR ASSURANCE SYSTEMS CRITERIA ATTACHMENT 1, APPENDIX A
DOE O 226.1A, IMPLEMENTATION OF DEPARTMENT OF ENERGY OVERSIGHT POLICY CONTRACTOR ASSURANCE SYSTEMS CRITERIA ATTACHMENT 1, APPENDIX A DEFINITIONS Assurance systems encompass all aspects of the processes
IT SECURITY EDUCATION AWARENESS TRAINING POLICY OCIO-6009-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS V. POLICY VI. RESPONSIBILITIES
Data Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
State of Oregon. State of Oregon 1
State of Oregon State of Oregon 1 Table of Contents 1. Introduction...1 2. Information Asset Management...2 3. Communication Operations...7 3.3 Workstation Management... 7 3.9 Log management... 11 4. Information
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL INDEPENDENT EVALUATION OF THE NATIONAL CREDIT UNION ADMINISTRATION S COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA)
2012 FISMA Executive Summary Report
2012 FISMA Executive Summary Report March 29, 2013 UNITED STATES SECURITIES AND EXCHANGE COMMISSION WASHINGTON, D.C. 20549 OI'!'ICEOI' lnstfl! C1'0R GENERAt MEMORANDUM March 29,2013 To: Jeff Heslop, Chief
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections. Evaluation Report
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections Evaluation Report The Department's Unclassified Cyber Security Program - 2012 DOE/IG-0877 November 2012 MEMORANDUM FOR
STATE OF NORTH CAROLINA
STATE OF NORTH CAROLINA INFORMATION SYSTEMS AUDIT OFFICE OF INFORMATION TECHNOLOGY SERVICES INFORMATION TECHNOLOGY GENERAL CONTROLS OCTOBER 2014 OFFICE OF THE STATE AUDITOR BETH A. WOOD, CPA STATE AUDITOR
How To Check If Nasa Can Protect Itself From Hackers
SEPTEMBER 16, 2010 AUDIT REPORT OFFICE OF AUDITS REVIEW OF NASA S MANAGEMENT AND OVERSIGHT OF ITS INFORMATION TECHNOLOGY SECURITY PROGRAM OFFICE OF INSPECTOR GENERAL National Aeronautics and Space Administration
Miami University. Payment Card Data Security Policy
Miami University Payment Card Data Security Policy IT Policy IT Standard IT Guideline IT Procedure IT Informative Issued by: IT Services SCOPE: This policy covers all units within Miami University that
HUMAN RESOURCES MANAGEMENT NETWORK (HRMN) SELF-SERVICE
PERFORMANCE AUDIT OF HUMAN RESOURCES MANAGEMENT NETWORK (HRMN) SELF-SERVICE DEPARTMENT OF CIVIL SERVICE July 2004 ...The auditor general shall conduct post audits of financial transactions and accounts
Best Practices Report
Overview As an IT leader within your organization, you face new challenges every day from managing user requirements and operational needs to the burden of IT Compliance. Developing a strong IT general
Guide to Vulnerability Management for Small Companies
University of Illinois at Urbana-Champaign BADM 557 Enterprise IT Governance Guide to Vulnerability Management for Small Companies Andrew Tan Table of Contents Table of Contents... 1 Abstract... 2 1. Introduction...
OVERVIEW. In all, this report makes recommendations in 14 areas, such as. Page iii
The Office of the Auditor General has conducted a procedural review of the State Data Center (Data Center), a part of the Arizona Strategic Enterprise Technology (ASET) Division within the Arizona Department
Independent Evaluation of NRC s Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2015
Independent Evaluation of NRC s Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2015 OIG-16-A-03 November 12, 2015 All publicly available OIG reports (including
University System of Maryland University of Baltimore
Audit Report University System of Maryland University of Baltimore May 2005 OFFICE OF LEGISLATIVE AUDITS DEPARTMENT OF LEGISLATIVE SERVICES MARYLAND GENERAL ASSEMBLY This report and any related follow-up
VA Office of Inspector General
VA Office of Inspector General OFFICE OF AUDITS & EVALUATIONS Department of Veterans Affairs Federal Information Security Management Act Audit for Fiscal Year 2014 May 19, 2015 14-01820-355 ACRONYMS CRISP
EVALUATION REPORT. The Department of Energy's Unclassified Cybersecurity Program 2014
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections EVALUATION REPORT The Department of Energy's Unclassified Cybersecurity Program 2014 DOE/IG-0925 October 2014 Department
IT Security Incident Management Policies and Practices
IT Security Incident Management Policies and Practices Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology Date: Feb 6, 2015 i Document Control Document
PreK 12 Practicum and Internship. School Counseling. Overview
PreK 12 Practicum and Internship School Counseling Overview Counseling and Development Program Mission Statement The Counseling and Development program is committed to prepare counselors who promote the
North European Functional Airspace Block Avinor, Norway EANS, Estonia Finavia, Finland LGS, Latvia. NEFAB Project CHANGE MANAGEMENT MANUAL
NEFAB Project CHANGE MANAGEMENT MANUAL Version 0.5 Page 1 of 38 Revision history Version Date Description Approved 0.5 14/12/2011 Page 2 of 38 Table of Contents 1. Introduction... 4 1.1. The Scope of this
Data Center Colocation - SLA
1 General Overview This is a Service Level Agreement ( SLA ) between and Data Center Colocation to document: The technology services Data Center Colocation provides to the customer The targets for response
How To Audit The Mint'S Information Technology
Audit Report OIG-05-040 INFORMATION TECHNOLOGY: Mint s Computer Security Incident Response Capability Needs Improvement July 13, 2005 Office of Inspector General Department of the Treasury Contents Audit
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Audit of the Department of State Information Security Program
UNITED STATES DEPARTMENT OF STATE AND THE BROADCASTING BOARD OF GOVERNORS OFFICE OF INSPECTOR GENERAL AUD-IT-15-17 Office of Audits October 2014 Audit of the Department of State Information Security Program
FINAL DOCUMENT. Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers Part 1: General Requirements
GHTF/SG4/N28R4:2008 FINAL DOCUMENT Title: Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers Authoring Group: GHTF Study Group 4 Endorsed by: The Global Harmonization
Information Security Operational Procedures Banner Student Information System Security Policy
Policy No: 803 Area: Information Technology Services Adopted: 8/6/2012 Information Security Operational Procedures Banner Student Information System Security Policy INTRODUCTION This document provides
United States Patent and Trademark Office
U.S. DEPARTMENT OF COMMERCE Office of Inspector General United States Patent and Trademark Office FY 2009 FISMA Assessment of the Patent Cooperation Treaty Search Recordation System (PTOC-018-00) Final
ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster
Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)
Information Technology Project Oversight Framework
i This Page Intentionally Left Blank i Table of Contents SECTION 1: INTRODUCTION AND OVERVIEW...1 SECTION 2: PROJECT CLASSIFICATION FOR OVERSIGHT...7 SECTION 3: DEPARTMENT PROJECT MANAGEMENT REQUIREMENTS...11
Linac Coherent Light Source (LCLS)
Linac Coherent Light Source (LCLS) An X Ray Free Electron Laser LLNL Quality Implementation Plan PMD 003 r0 May 2004 Prepared for the US Department of Energy under contract numbers: SLAC DE AC03 76SF00515
POSTAL REGULATORY COMMISSION
POSTAL REGULATORY COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT INFORMATION SECURITY MANAGEMENT AND ACCESS CONTROL POLICIES Audit Report December 17, 2010 Table of Contents INTRODUCTION... 1 Background...1
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION Customer Account Data Engine 2 (CADE 2): System Requirements and Testing Processes Need Improvements September 28, 2012 Reference Number: 2012-20-122 This
Information security controls. Briefing for clients on Experian information security controls
Information security controls Briefing for clients on Experian information security controls Introduction Security sits at the core of Experian s operations. The vast majority of modern organisations face
Summary of CIP Version 5 Standards
Summary of CIP Version 5 Standards In Version 5 of the Critical Infrastructure Protection ( CIP ) Reliability Standards ( CIP Version 5 Standards ), the existing versions of CIP-002 through CIP-009 have
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT: U.S. Election Assistance Commission Compliance with the Requirements of the Federal Information Security Management Act Fiscal
Department of the Interior Privacy Impact Assessment
Department of the Interior September 8, 2014 Name of Project: Enterprise Data-at Rest (DAR) Encryption Bureau: Office of the Secretary Project s Unique ID: 010-000000666 Once the PIA is completed and the
Security Standard: Servers, Server-based Applications and Databases
Security Standard: Servers, Server-based Applications and Databases Scope This standard applies to all servers (including production, training, test, and development servers) and the operating system,
FedRAMP Standard Contract Language
FedRAMP Standard Contract Language FedRAMP has developed a security contract clause template to assist federal agencies in procuring cloud-based services. This template should be reviewed by a Federal
REPORT ON FY 2006 FISMA AUDIT OF THE SMITHSONIAN INSTITUTION S INFORMATION SECURITY PROGRAM
REPORT ON FY 2006 FISMA AUDIT OF THE SMITHSONIAN INSTITUTION S INFORMATION SECURITY PROGRAM Cotton & Company LLP Auditors Advisors 635 Slaters Lane, 4 th Floor Alexandria, Virginia 22314 703.836.6701 www.cottoncpa.com
MANAGING THE CONFIGURATION OF INFORMATION SYSTEMS WITH A FOCUS ON SECURITY
MANAGING THE CONFIGURATION OF INFORMATION SYSTEMS WITH A FOCUS ON SECURITY Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute of Standards and Technology
California State Polytechnic University, Pomona. Desktop Security Standard and Guidelines
California State Polytechnic University, Pomona Desktop Security Standard and Guidelines Version 1.7 February 1, 2008 Table of Contents OVERVIEW...3 AUDIENCE...3 MINIMUM DESKTOP SECURITY STANDARD...3 ROLES
Final Audit Report -- CAUTION --
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Audit of the Information Technology Security Controls of the U.S. Office of Personnel Management
CHIS, Inc. Privacy General Guidelines
CHIS, Inc. and HIPAA CHIS, Inc. provides services to healthcare facilities and uses certain protected health information (PHI) in connection with performing these services. Therefore, CHIS, Inc. is classified
Office of Inspector General SECURITY OF SCIENCE AND ECOSYSTEMS SUPPORT DIVISION (SESD) LOCAL AREA NETWORK (LAN)
Office of Inspector General Report of Audit SECURITY OF SCIENCE AND ECOSYSTEMS SUPPORT DIVISION (SESD) LOCAL AREA NETWORK (LAN) SEPTEMBER 30, 1997 Audit Report E1NMF7-15-0001-7100309 Inspector General
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION Treasury Inspector General for Tax Administration Federal Information Security Management Act Report October 27, 2009 Reference Number: 2010-20-004 This
The President s Critical Infrastructure Protection Board. Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
cover_comp_01 9/9/02 5:01 PM Page 1 For further information, please contact: The President s Critical Infrastructure Protection Board Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
NIST 800-53A: Guide for Assessing the Security Controls in Federal Information Systems. Samuel R. Ashmore Margarita Castillo Barry Gavrich
NIST 800-53A: Guide for Assessing the Security Controls in Federal Information Systems Samuel R. Ashmore Margarita Castillo Barry Gavrich CS589 Information & Risk Management New Mexico Tech Spring 2007
Network Assessment. Prepared For: Prospect Or Customer Prepared By: Your Company Name
Network Assessment Prepared For: Prospect Or Customer Prepared By: Your Company Name Environment Risk and Issue Score Issue Review Next Steps Agenda Environment - Overview Domain Domain Controllers 4 Number
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections Audit Report Management of Western Area Power Administration's Cyber Security Program DOE/IG-0873 October 2012 Department
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING INFORMATION TECHNOLOGY POLICY Name Of Policy: System and Information Integrity Policy Domain: Security Date Issued: 06/22/11
Procedure Manual. Number: A6Hx2-8.01a. Title: College Network and Software Usage by Employees. Policy Number: 6Hx2-8.01 1 of 21
Policy 6Hx2-8.01 1 of 21 Broward College provides all of its employees with College Network and Internet access so that they can obtain up-to-date information useful to them for the performance of their
Significant Revisions to OMB Circular A-127. Section Revision to A-127 Purpose of Revision Section 1. Purpose
Significant Revisions to OMB Circular A-127 Section Revision to A-127 Purpose of Revision Section 1. Purpose Section 5. Definitions Section 6. Policy Section 7. Service Provider Requirements Section 8.
OFFICE OF INDEPENDENT OVERSIGHT OFFICE OF CYBER SECURITY EVALUATIONS APPRAISAL PROCESS GUIDE
OFFICE OF INDEPENDENT OVERSIGHT OFFICE OF CYBER SECURITY EVALUATIONS APPRAISAL PROCESS GUIDE April 2008 Office of Health, Safety and Security U.S. Department of Energy Preface Preface Department of Energy
REPORT 2016/035 INTERNAL AUDIT DIVISION
INTERNAL AUDIT DIVISION REPORT 2016/035 Audit of the use of consultants and individual contractors in the United Nations Stabilization Mission in Haiti Overall results relating to the effective hiring
Information Technology Project Oversight Framework
State of California California Technology Agency Information Technology Project Oversight Framework SIMM Section 45 Revised April 2011 This Page Intentionally Left Blank California Technology Agency Table
Final Audit Report FEDERAL INFORMATION SECURITY MANAGEMENT ACT AUDIT FY 2012. Report No. 4A-CI-00-12-016
U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Subject: FEDERAL INFORMATION SECURITY MANAGEMENT ACT AUDIT FY 2012 Report No. 4A-CI-00-12-016 Date: