Standard: Data Center Security
|
|
|
- Juliet Stephens
- 8 years ago
- Views:
Transcription
1 Information Security Standards Data Center Security Standard IS-DCS Effective Date TBD # Version 3.0 Contact Mike Cook Phone Standard: Data Center Security Page 1
2 Executive Summary The university data centers provide for the reliable operation of SJSU s computing systems, computing infrastructure, and communication systems. Per ICSUAM 8000, California SAM, local, State, and Federal law, this standard defines the requirements for security controls of machines hosted in SJSU data centers to safeguarding the confidentiality, integrity, and availability of information stored, processed and transmitted by SJSU. Page 2
3 Revision History Date Action 4/25/2014 Draft sent to Mike 5/13/2014 Reviewed with comments and sent to Mike 12/1/2014 Reviewed. Content suggestions. Added comments. Hien Huynh Page 3
4 Table of Contents Executive Summary... 2 Introduction and Purpose... 5 Scope... 5 Standard... 5 Storage of Unencrypted Level 1 Information is prohibited on servers... 5 Physical and Environmental Security... 5 Background Check of Employees... 5 Electronic Lock Required... 5 Networking Equipment Locked... 5 Management Control of Access... 5 Physical Need to Access... 5 Removal of Permissions upon Employee separation... 5 Audit of Key Cards... 6 Master Keys... 6 Moisture Detectors... 6 Smoke Detectors... 6 Environmental Reporting... 6 Fire Suppression... 6 Uninterruptible Power Supply (UPS)... 6 Glass Windows... 6 Power Generators... 6 Earthquake Protection... 6 Firewalls between data centers and core networks... 6 Emergency Preparedness and Training... 6 Test Data Center Emergency Procedures... 6 IT Disaster Recovery Plan... 7 Backup Tapes... 7 Food, Drink, Hazardous Materials... 7 Labels on Doors... 7 Data Center Owner Training... 7 Page 4
5 Introduction and Purpose This standard defines the requirements for security controls of machines hosted in SJSU data centers. This standard is composed to explicitly comply with ICSUAM 8000, California SAM, local, State, and Federal law. Scope This standard applies to all SJSU State, Self-Fund, and Auxiliary ( campus ) computer systems and facilities, with a target audience of SJSU Information Technology employees and partners. This standard applies to any machine storing unencrypted Level 1 data at rest, any machine providing internet-facing services outside the campus border firewall (i.e. Web Servers), and campus core network aggregation points. Standard Storage of Unencrypted Level 1 Information is prohibited on servers For any machine on the campus, storing level 1 unencrypted data at rest on servers is prohibited unless that machine is hosted in an approved SJSU data center. For information classification and handling of Level 1 sensitive data, refer to the Information Classification and Handling Standard. Physical and Environmental Security Additional physical security controls are included in the Physical Security Standard. Background Check of Employees All new employees with entry access to data centers must pass a background check (Livescan) at time of hire. Electronic Lock Required Electronic locks are required on all entry doors to data centers storing level 1 data. Entry logs must be properly maintained showing who entered, time, and date. Entry logs must be maintained for at least 365 days. Networking Equipment Locked Networking equipment, including lab equipment, must be enclosed and locked. Management Control of Access Management needs to have control over access to assets. Physical Need to Access Physical access to locked data center rooms is based on the physical need to access principal. Physical access is limited to individuals required to have access. Service employees, including custodians, should not have electronic access to data center locked rooms. University Police personnel are authorized to access the data center in emergency situations only via electronic lock, if functional, or physical access if necessary. Removal of Permissions upon Employee separation Upon separation of employees, key cards and key should be immediately revoked. Alarm codes should be changed upon employee separation. Page 5
6 Audit of Key Cards Key cards and physical keys must be audited annually and approved by Data Center management (MPP). Master Keys Physical locks must not accept master keys. Moisture Detectors Moisture Detectors should be in use and placed in data centers, in accordance with the Physical Security Standard. Smoke Detectors Smoke Detectors should be in use and placed in data centers, in accordance with the Physical Security Standard. Environmental Reporting Environmental alerting, such as temperature and moisture is required for server rooms storing level 1 data. Fire Suppression Fire extinguisher or fire suppression for electronic equipment, must be located in each Data Center. Data Centers must not be protected by water-based fire suppression systems. Uninterruptible Power Supply (UPS) UPS power in the data center should be capable of handling backup power in room for minimum of 5 minutes to provide ample time for generator startup. Glass Windows Glass windows to public areas allowing viewing of server rooms are prohibited. Power Generators Power generators capable of sustaining computer operations during a power outage are required for servers storing level 1 data. Earthquake Protection Full-Height server racks which are in excess of three times as tall as they are wide must be affixed to the structure on at least 2 faces to prevent damage in the event of a minor earthquake. Firewalls between data centers and core networks Firewalls are required between SJSU data centers and the core networks, as specified in the Network Security Standard. Emergency Preparedness and Training All personnel with access to data center rooms must undergo emergency preparedness training on an annual basis, including learning how to operate fire extinguishers, suppression, and emergency alarms. Test Data Center Emergency Procedures All data center owners need to develop and test data center emergency procedures annually. Procedures must specify due care for safety and life preservation measures. Page 6
7 IT Disaster Recovery Plan Data Centers must have an IT Disaster Recovery Plan identifying the critical systems in the data center, the assets necessary for those applications, and the plans for resuming services after an unplanned disruption. Backup Tapes Data center room sensitive servers must use backup tapes sent to an offsite location, in accordance with the Data Retention Standard. Tapes containing level 1 data must be encrypted. Data center backup tapes must be in compliance with CSU Executive Order 1031: Records Retention & Disposition Schedules Food, Drink, Hazardous Materials Food, drink, and hazardous materials are prohibited in Data Centers. Labels on Doors Labels on doors that list data center or telecom closet are prohibited. Data Center Owner Training Data center owners must maintain procedures for training, including the following areas: gaining physical access, removing physical access, visitor access (including logging), stop tailgating, alarm arm/disarm procedures, cleanliness (dust removal), facility services, development access to data center (including logging), and change control (including documentation). Page 7
The Importance of Organizing Your SJSU Information Assets
Standard: Asset Control Page 1 Executive Summary The Asset Control Standard defines the requirements for controlling and ensuring all SJSU computing hardware, software, and confidential assets are identified,
Standard: Application Service Provider Security Requirements
Standard: Application Service Provider Security Requirements Page 1 Executive Summary SJSU has the option to select and contract with approved 3 rd parties, application service providers, services and
Standard: Email Retention
Information Security Standards Email Retention Standard IS-ER Effective Date TBD Email security@sjsu.edu # Version 2.0 Contact Mike Cook Phone 408-924-1705 Standard: Email Retention Page 1 Executive Summary
IT - General Controls Questionnaire
IT - General Controls Questionnaire Internal Control Questionnaire Question Yes No N/A Remarks G1. ACCESS CONTROLS Access controls are comprised of those policies and procedures that are designed to allow
Standard: Event Monitoring
Standard: Event Monitoring Page 1 Executive Summary The Event Monitoring Standard defines the requirements for Information Security event monitoring within SJSU computing resources to ensure that information
Standard: Information Security Awareness Training
Standard: Information Security Awareness Training Page 1 Executive Summary San Jose State University (SJSU) is highly diversified in the information that it collects and maintains on its community members.
University of California, Riverside Computing and Communications. IS3 Local Campus Overview Departmental Planning Template
University of California, Riverside Computing and Communications IS3 Local Campus Overview Departmental Planning Template Last Updated April 21 st, 2011 Table of Contents: Introduction Security Plan Administrative
CITY UNIVERSITY OF HONG KONG Physical Access Security Standard
CITY UNIVERSITY OF HONG KONG (Approved by the Information Strategy and Governance Committee in December 2013) PUBLIC Date of Issue: 2013-12-24 Document Control Document Owner Classification Publication
Data Center Operations and Security Requirements
DATA CENTER OPERATIONS CALIFORNIA STATE UNIVERSITY, CHANNEL ISLANDS Audit Report 12-36 November 2, 2012 Henry Mendoza, Chair William Hauck, Vice Chair Lupe C. Garcia Steven M. Glazer Hugo N. Morales Glen
IT Security Standard: Computing Devices
IT Security Standard: Computing Devices Revision History: Date By Action Pages 09/30/10 ITS Release of New Document Initial Draft Review Frequency: Annually Responsible Office: ITS Responsible Officer:
Standard: Network Security
Standard: Network Security Page 1 Executive Summary Network security is important in the protection of our network and services from unauthorized modification, destruction, or disclosure. It is essential
Standard: Email and Campus Communication
Information Security Standards Email and Campus Communication Standard IS-ECC Effective Date TBD Email security@sjsu.edu # Version 2.0 Contact Mike Cook Phone 408-924-1705 Standard: Email and Campus Communication
Standard: Information Security Incident Management
Standard: Information Security Incident Management Page 1 Executive Summary California State University Information Security Policy 8075.00 states security incidents involving loss, damage or misuse of
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis
Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University
Standard: Vulnerability Management and Assessment
Standard: Vulnerability Management and Assessment Page 1 Executive Summary San Jose State University (SJSU) is highly diversified in the information that it collects and maintains on its community members.
SITECATALYST SECURITY
SITECATALYST SECURITY Ensuring the Security of Client Data June 6, 2008 Version 2.0 CHAPTER 1 1 Omniture Security The availability, integrity and confidentiality of client data is of paramount importance
FORM 20A.9 SAMPLE AUDIT PROGRAM FOR TESTING IT CONTROLS. Date(s) Completed. Workpaper Reference
FORM 20A.9 SAMPLE AUDIT PROGRAM FOR TESTING IT CONTROLS Workpaper Reference Date(s) Completed Organization and Staffing procedures used to define the organization of the IT Department. 2. Review the organization
REVIEWED ICT DATA CENTRE PHYSICAL ACCESS AND ENVIROMENTAL CONTROL POLICY
LI_M_POPO PROVINCIAL GOVERNMENT :;:ED.JBl-C ()F SO"';-H AFR;IC. ':.,. DEPARTMENT OF CO-OPERATIVE GOVERNANCE, HUMAN SETTLEMENTS & TRADITIONAL AFFAIRS REVIEWED ICT DATA CENTRE PHYSICAL ACCESS AND ENVIROMENTAL
DATA CENTER OPERATIONS CALIFORNIA STATE UNIVERSITY, EAST BAY. Audit Report 12-33 September 4, 2012
DATA CENTER OPERATIONS CALIFORNIA STATE UNIVERSITY, EAST BAY Audit Report 12-33 September 4, 2012 Henry Mendoza, Chair William Hauck, Vice Chair Steven M. Glazer Lupe C. Garcia Hugo N. Morales Glen O.
MARULENG LOCAL MUNICIPALITY
MARULENG LOCAL MUNICIPALITY Data Centre Physical Access and Environmental Control Policy Draft: Data Centre Access Control and Environmental Policy Page 1 Version Control Version Date Author(s) Details
IT NETWORK AND INFRASTRUCTURE FILE SERVER POLICY (for Cheshire CCGs)
IT NETWORK AND INFRASTRUCTURE FILE SERVER POLICY (for Cheshire CCGs) Version 3.2 Ratified By Date Ratified November 2014 Author(s) Responsible Committee / Officers Issue Date November 2014 Review Date
Auditing in an Automated Environment: Appendix C: Computer Operations
Agency Prepared By Initials Date Reviewed By Audit Program - Computer Operations W/P Ref Page 1 of 1 Procedures Initials Date Reference/Comments OBJECTIVE - To document the review of the computer operations
Information Technology Services Guidelines
Page 1 of 10 Table of Contents 1. Purpose... 2 2. Entities Affected by This Guideline... 2 3. Definitions... 2 4. Guidelines... 3 4.1 Requesting Data Center or... 3 4.2 Requirements for Data Center or...
California State University, Sacramento INFORMATION SECURITY PROGRAM
California State University, Sacramento INFORMATION SECURITY PROGRAM 1 I. Preamble... 3 II. Scope... 3 III. Definitions... 4 IV. Roles and Responsibilities... 5 A. Vice President for Academic Affairs...
DATA CENTER OPERATIONS CALIFORNIA STATE UNIVERSITY, CHICO. Audit Report 12-35 October 19, 2012
DATA CENTER OPERATIONS CALIFORNIA STATE UNIVERSITY, CHICO Audit Report 12-35 October 19, 2012 Henry Mendoza, Chair William Hauck, Vice Chair Lupe C. Garcia Steven M. Glazer Hugo N. Morales Glen O. Toney
Audit Report on the New York City Police Department Data Center 7A06-093
Audit Report on the New York City Police Department Data Center 7A06-093 August 14, 2006 THE CITY OF NEW YORK OFFICE OF THE COMPTROLLER 1 CENTRE STREET NEW YORK, N.Y. 10007-2341 WILLIAM C. THOMPSON, JR.
IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]
![IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]](/thumbs/26/7758795.jpg "IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]")
IBX Business Network Platform Information Security Controls 2015-02- 20 Document Classification [Public] Table of Contents 1. General 2 2. Physical Security 2 3. Network Access Control 2 4. Operating System
Physical and Environment IT Security Standards
Physical and Environment IT Security Standards Author s Name: Jo Brown Author s Job Title: Head of Technical Services Division: Corporate Department: Technical Services Version Number: 1.0 Ratifying Committee:
Application Development within University. Security Checklist
Application Development within University Security Checklist April 2011 The Application Development using data from the University Enterprise Systems or application Development for departmental use security
Tufts Health Plan Corporate Continuity Strategy
Tufts Health Plan Corporate Continuity Strategy July 2015 OVERVIEW The intent of this document is to provide external customers and auditors with a highlevel overview of the Tufts Health Plan Corporate
OFFICE OF THE STATE AUDITOR General Controls Review Questionnaire
OFFICE OF THE STATE AUDITOR Agency: * University Please answer all of the following questions. Where we ask for copies of policies and procedures and other documentation, we would prefer this in electronic
System Security Plan University of Texas Health Science Center School of Public Health
System Security Plan University of Texas Health Science Center School of Public Health Note: This is simply a template for a NIH System Security Plan. You will need to complete, or add content, to many
Physical Security Policy
Physical Security Policy Author: Policy & Strategy Team Version: 0.8 Date: January 2008 Version 0.8 Page 1 of 7 Document Control Information Document ID Document title Sefton Council Physical Security
ICT NETWORK AND INFRASTRUCTURE FILE SERVER POLICY
ICT NETWORK AND INFRASTRUCTURE FILE SERVER POLICY Version 1.0 Ratified By Date Ratified Author(s) Responsible Committee / Officers Issue Date Review Date Intended Audience Impact Assessed CCG Committee
Gramm Leach Bliley Act. GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007
Gramm Leach Bliley Act 15 U.S.C. 6801-6809 6809 GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007 1 Objectives for GLBA Training GLBA Overview Safeguards Rule
Supplier Information Security Addendum for GE Restricted Data
Supplier Information Security Addendum for GE Restricted Data This Supplier Information Security Addendum lists the security controls that GE Suppliers are required to adopt when accessing, processing,
Rotherham CCG Network Security Policy V2.0
Title: Rotherham CCG Network Security Policy V2.0 Reference No: Owner: Author: Andrew Clayton - Head of IT Robin Carlisle Deputy - Chief Officer D Stowe ICT Security Manager First Issued On: 17 th October
Summary of Technical Information Security for Information Systems and Services Managed by NUIT (Newcastle University IT Service)
Introduction This document provides a summary of technical information security controls operated by Newcastle University s IT Service (NUIT). These information security controls apply to all NUIT managed
HIPAA Privacy and Security Risk Assessment and Action Planning
HIPAA Privacy and Security Risk Assessment and Action Planning Practice Name: Participants: Date: MU Stage: EHR Vendor: Access Control Unique ID and PW for Users (TVS016) Role Based Access (TVS023) Account
IT NETWORK AND INFRASTRUCTURE FILE SERVER POLICY
IT NETWORK AND INFRASTRUCTURE FILE SERVER POLICY Version 3.0 Ratified By Date Ratified April 2013 Author(s) Responsible Committee / Officers Issue Date January 2014 Review Date Intended Audience Impact
FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
Lauren Hamill, Information Governance Officer. Version Release Author/Reviewer Date Changes (Please identify page no.) 1.0 L.
Document No: IG10d Version: 1.1 Name of Procedure: Third Party Due Diligence Assessment Author: Release Date: Review Date: Lauren Hamill, Information Governance Officer Version Control Version Release
ICT Policy. Executive Summary. Date of ratification Executive Team Committee 22nd October 2013. Document Author(s) Collette McQueen
ICT Policy THCCGIT20 Version: 01 Executive Summary This document defines the Network Infrastructure and File Server Security Policy for Tower Hamlets Clinical Commissioning Group (CCG). The Network Infrastructure
TUFTS HEALTH PLAN CORPORATE CONTINUITY STRATEGY FREQUENTLY ASKED QUESTIONS OVERVIEW CORPORATE CONTINUITY PROGRAM.
TUFTS HEALTH PLAN CORPORATE CONTINUITY STRATEGY FREQUENTLY ASKED QUESTIONS July 2015 OVERVIEW The intent of this document is to provide external customers and auditors with a high-level overview of the
Version 1.0. Ratified By
ICT NETWORK AND INFRASTRUCTURE FILE SERVER POLICY Version 1.0 Ratified By Date Ratified 5 th March 2013 Author(s) Responsible Committee / Officers Issue Date 5 th March 2013 Review Date Intended Audience
Supplier Security Assessment Questionnaire
HALKYN CONSULTING LTD Supplier Security Assessment Questionnaire Security Self-Assessment and Reporting This questionnaire is provided to assist organisations in conducting supplier security assessments.
VIRGINIA STATE UNIVERSITY RISK ANALYSIS SURVEY INFORMATION TECHNOLOGY
ASSESSABLE UNIT: ENTER THE NAME OF YOUR ASSESSABLE UNIT HERE BUSINESS PROCESS: ENTER YOUR BUSINESS PROCESS HERE BANNER INDEX CODE: ENTER YOUR BANNER INDEX CODE HERE Risk: If you monitor the activity and
Hosted Testing and Grading
Hosted Testing and Grading Technical White Paper July 2014 www.lexmark.com Lexmark and Lexmark with diamond design are trademarks of Lexmark International, Inc., registered in the United States and/or
ANNEXURE 07: CHECK-LIST FOR OFF-SITE STORAGE FACILITIES
ANNEXURE 07: CHECK-LIST FOR OFF-SITE STORAGE FACILITIES NAME OF PRIVATE STORAGE FACILITY: DATE VISITED: 1. COMPANY PROFILE 1.1 What is the company's mission? 1.2 How does that mission compare with the
Network Security Policy
IGMT/15/036 Network Security Policy Date Approved: 24/02/15 Approved by: HSB Date of review: 20/02/16 Policy Ref: TSM.POL-07-12-0100 Issue: 2 Division/Department: Nottinghamshire Health Informatics Service
HIPAA RISK ASSESSMENT
HIPAA RISK ASSESSMENT PRACTICE INFORMATION (FILL OUT ONE OF THESE FORMS FOR EACH LOCATION) Practice Name: Address: City, State, Zip: Phone: E-mail: We anticipate that your Meaningful Use training and implementation
ULH-IM&T-ISP06. Information Governance Board
Network Security Policy Policy number: Version: 2.0 New or Replacement: Approved by: ULH-IM&T-ISP06 Replacement Date approved: 30 th April 2007 Name of author: Name of Executive Sponsor: Name of responsible
PCI Data Security and Classification Standards Summary
PCI Data Security and Classification Standards Summary Data security should be a key component of all system policies and practices related to payment acceptance and transaction processing. As customers
Security Control Standard
Department of the Interior Security Control Standard Physical and Environmental Protection April 2011 Version: 1.1 Signature Approval Page Designated Official Bernard J. Mazer, Department of the Interior,
Data Protection. Secure Media Management. Offsite Tape Vaulting Drives Efficiencies, Enhances Control and Improves Audit Readiness
Data Protection Secure Media Management Offsite Tape Vaulting Drives Efficiencies, Enhances Control and Improves Audit Readiness Data Protection Safeguarding your organization s information with: Media
Ohio Supercomputer Center
Ohio Supercomputer Center IT Business Continuity Planning No: Effective: OSC-13 06/02/2009 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original
BKDconnect Security Overview
BKDconnect Security Overview 1 Introduction 1.1 What is BKDconnect 1.2 Site Creation 1.3 Client Authentication and Access 2 Security Design 2.1 Confidentiality 2.1.1 Least Privilege and Role Based Security
INFORMATION SECURITY California Maritime Academy
CSU The California State University Office of Audit and Advisory Services INFORMATION SECURITY California Maritime Academy Audit Report 14-54 April 8, 2015 Senior Director: Mike Caldera IT Audit Manager:
Resource Ordering and Status System. User Business Resumption Plan
Resource Ordering and Status System User Business Resumption Plan I. INTRODUCTION This document is the disaster preparedness and recovery plan for users of the Resource Ordering and Statusing System (ROSS).
HIPAA Security Alert
Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information
Information Technology General Controls Review (ITGC) Audit Program Prepared by:
Information Technology General Controls Review (ITGC) Audit Program Date Prepared: 2012 Internal Audit Work Plan Objective: IT General Controls (ITGC) address the overall operation and activities of the
How To Plan For A Disaster At The University Of Texas
Disaster Recovery Planning The Process Introduction We began our planning processes after experiencing several disasters, including a building fire, an environmental contamination, faulty discharge of
Mike Casey Director of IT
Network Security Developed in response to: Contributes to HCC Core Standard number: Type: Policy Register No: 09037 Status: Public IG Toolkit, Best Practice C7c Consulted With Post/Committee/Group Date
Log Management Standard 1.0 INTRODUCTION 2.0 SYSTEM AND APPLICATION MONITORING STANDARD. 2.1 Required Logging
Log Management Standard Effective Date: 7/28/2015 1.0 INTRODUCTION The California State University, Chico system/application log management standard identifies event logging requirements, log review frequency,
White Paper: Librestream Security Overview
White Paper: Librestream Security Overview TABLE OF CONTENTS 1 SECURITY OVERVIEW... 3 2 USE OF SECURE DATA CENTERS... 3 3 SECURITY MONITORING, INTERNAL TESTING AND ASSESSMENTS... 4 3.1 Penetration Testing
BNA FEDERAL CREDIT UNION DISASTER RECOVERY PLAN
BNA FEDERAL CREDIT UNION DISASTER RECOVERY PLAN INTRODUCTION The need for a contingency plan for business interruptions is vital to the operations of the BNA Federal Credit Union. Without such a plan,
Tk20 Network Infrastructure
Tk20 Network Infrastructure Tk20 Network Infrastructure Table of Contents Overview... 4 Physical Layout... 4 Air Conditioning:... 4 Backup Power:... 4 Personnel Security:... 4 Fire Prevention and Suppression:...
UNIFIED MEETING 5 SECURITY WHITEPAPER INFO@INTERCALL.COM INTERCALL.COM 800.820.5855 1
UNIFIED MEETING 5 SECURITY WHITEPAPER INFO@INTERCALL.COM INTERCALL.COM 800.820.5855 1 As organizations unlock the true potential of meeting over the web as an alternative to costly and timeconsuming travel,
The Commonwealth of Massachusetts
The Commonwealth of Massachusetts AUDITOR OF THE COMMONWEALTH ONE ASHBURTON PLACE, ROOM 1819 Boston, MASSACHUSETTS 02108 TEL. (617) 727-6200 A. JOSEPH DeNUCCI AUDITOR No. 2008-0243-4T OFFICE OF THE STATE
Information Security. Manual Guideline. Version 3
Information Security Manual Guideline Version 3 Group Risk TABLE OF CONTENTS Document Control and Revisions Logs... 4 1 Purpose... 5 2 Scope... 5 3 Policy Statement... 6 4 Terms and definitions... 7 5
C.T. Hellmuth & Associates, Inc.
Technical Monograph C.T. Hellmuth & Associates, Inc. Technical Monographs usually are limited to only one subject which is treated in considerably more depth than is possible in our Executive Newsletter.
CONTINUITY AND RECOVERY PLANNING GUIDE
CONTINUITY AND RECOVERY PLANNING GUIDE The Continuity Planning process is designed to assist an organization in determining action plans for disaster recovery or incident response. The process also aids
Best Practices For Department Server and Enterprise System Checklist
Best Practices For Department Server and Enterprise System Checklist INSTRUCTIONS Information Best Practices are guidelines used to ensure an adequate level of protection for Information Technology (IT)
ISO IEC 27002 2005 (17799 2005) INFORMATION SECURITY AUDIT TOOL
9.1 USE SECURITY AREAS TO PROTECT FACILITIES 1 GOAL Do you use physical methods to prevent unauthorized access to your organization s information and premises? 2 GOAL Do you use physical methods to prevent
Approved by President Mohammed Qayoumi. Reviews: IT Management Advisory Committee
Policy History Date Action Approved by President Mohammed Qayoumi May 27, 2013 April 9, 2013 Reviews: IT Management Advisory Committee Draft Policy Released Table of Contents Introduction and Purpose...
Administrative Procedure
Administrative Procedure Effective: 12/21/2012 Supersedes: N/A Page: 1 of 5 Subject: SECURITY ALARMS 1.0. PURPOSE: The purpose of this procedure is to coordinate and control the installation, monitoring,
CHIS, Inc. Privacy General Guidelines
CHIS, Inc. and HIPAA CHIS, Inc. provides services to healthcare facilities and uses certain protected health information (PHI) in connection with performing these services. Therefore, CHIS, Inc. is classified
DISASTER RECOVERY PLAN
DISASTER RECOVERY PLAN Section 1. Goals of a Disaster Recovery Plan The major goals of a disaster recovery plan are: To minimize interruptions to normal operations. To limit the extent of disruption and
Retention & Destruction
Last Updated: March 28, 2014 This document sets forth the security policies and procedures for WealthEngine, Inc. ( WealthEngine or the Company ). A. Retention & Destruction Retention & Destruction of
HIPAA Information Security Overview
HIPAA Information Security Overview Security Overview HIPAA Security Regulations establish safeguards for protected health information (PHI) in electronic format. The security rules apply to PHI that is
Powering the Cloud Desktop: OS33 Data Centers
OS33 Data Centers info@os33.com (866) 796-0310 www.os33.com It is hard to overstate the importance of security and uptime, which is why we obsess over making sure that your corporate information assets
INFORMATION SECURITY SPECIFIC VENDOR COMPLIANCE PROGRAM (VCP) ACME Consulting Services, Inc.
INFORMATION SECURITY SPECIFIC VENDOR COMPLIANCE PROGRAM (VCP) ACME Consulting Services, Inc. Copyright 2016 Table of Contents INSTRUCTIONS TO VENDORS 3 VENDOR COMPLIANCE PROGRAM OVERVIEW 4 VENDOR COMPLIANCE
This document and the information contained herein are the property of Bowman Systems L.L.C. and should be considered business sensitive.
SERVICEPOINT SECURING CLIENT DATA This document and the information contained herein are the property of and should be considered business sensitive. Copyright 2006 333 Texas Street Suite 300 Shreveport,
Standard: Web Application Development
Information Security Standards Web Application Development Standard IS-WAD Effective Date TBD Email security@sjsu.edu # Version 2.0 Contact Mike Cook Phone 408-924-1705 Standard: Web Application Development
The Practice of Internal Controls. Cornell Municipal Clerks School July 16, 2014
The Practice of Internal Controls Cornell Municipal Clerks School July 16, 2014 Page 1 July 18, 2014 Cash Receipts (Collection procedures) Centralize cash collections within a department or for the local
The City of New York Office of the Comptroller Bureau of Financial Audit EDP Audit Division
The City of New York Office of the Comptroller Bureau of Financial Audit EDP Audit Division WILLIAM C. THOMPSON, JR. Comptroller Follow-Up Report on the New York City Fire Department Arson Information
RECORDS MANAGEMENT RECORDS MANAGEMENT SERVICES. Cost-Effective, Legally Defensible Records Management
RECORDS MANAGEMENT RECORDS MANAGEMENT SERVICES Cost-Effective, Legally Defensible Records Management Does This Sound Familiar? A data breach could send our share price tumbling. I need to minimise our
Silent Safety: Best Practices for Protecting the Affluent
Security Checklists Security Checklists 1. Operational Security Checklist 2. Physical Security Checklist 3. Systems Security Checklist 4. Travel Protocol Checklist 5. Financial Controls Checklist In a
MICHIGAN AUDIT REPORT OFFICE OF THE AUDITOR GENERAL THOMAS H. MCTAVISH, C.P.A. AUDITOR GENERAL
MICHIGAN OFFICE OF THE AUDITOR GENERAL AUDIT REPORT THOMAS H. MCTAVISH, C.P.A. AUDITOR GENERAL The auditor general shall conduct post audits of financial transactions and accounts of the state and of all
SNAP WEBHOST SECURITY POLICY
SNAP WEBHOST SECURITY POLICY Should you require any technical support for the Snap survey software or any assistance with software licenses, training and Snap research services please contact us at one
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8.
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 1 Table of Contents Overview /Standards: I. Information Security Policy/Standards Preface...5 I.1 Purpose....5
MARQUIS DISASTER RECOVERY PLAN (DRP)
MARQUIS DISASTER RECOVERY PLAN (DRP) Disaster Recovery is an ongoing process to plan, develop, test and implement changes, processes and procedures supporting the recovery of the critical functions in
Standard: Patching and Malicious Code Management
Standard: Patching and Malicious Code Management Page 1 Executive Summary San Jose State University (SJSU) is highly diversified in the information that it collects and maintains on its community members.
Alabama State Port Authority
DISASTER RECOVERY HOTSITE REQUEST FOR PROPOSAL Alabama State Port Authority Issued April 27, 2010 Alabama State Port Authority Table of Contents 1.0 OVERVIEW... 1 1.1 INTRODUCTION... 1 1.2 SCHEDULE OF
WASTE Application Form - Dublin Waste to Energy SECTION J ACCIDENT PREVENTION & EMERGENCY RESPONSE
SECTION J ACCIDENT PREVENTION & EMERGENCY RESPONSE Describe the existing or proposed measures, including emergency procedures, to minimise the impact on the environment of an accidental emission or spillage.
How To Ensure Network Security
NETWORK SECURITY POLICY Policy approved by: Assurance Committee Date: 3 December 2014 Next Review Date: December 2016 Version: 1.0 Page 1 of 12 Review and Amendment Log/Control Sheet Responsible Officer:
Risk and its Impact to(insert company name here) Risk AFTER Mitigation. Objective (A-D)
Contributed 11/29/99 by Virginia Sutton Corporate Audit Department Date: Audit Project: Mission: Process: Objective A: Objective B: Objective C: Objective D: Physical Security
Continuity Planning and Disaster Recovery
Responsible Officer: AVP - Information Technology Services & UC Chief Information Officer Responsible Office: IT - Information Technology Services Issuance Date: 7/27/2007 Effective Date: 7/27/2007 Scope: