Implementing Information Security Policies and Standards. A Real Life Example
|
|
|
- Harvey Mitchell
- 10 years ago
- Views:
Transcription
1 Implementing Information Security Policies and Standards A Real Life Example Bruce W. Edwards Manager Audit and Assurance - TAS
2 What we will review 1. Understand InfoSec, why should we? 2. Assess Your organisation s situation 3. Act Address your organisation s situation 4. Maintain Appropriate Information Security which supports privacy
3 Understand InfoSec, why should we? Recent events check the media! Example - The GCIO security review was prompted by a specific security breach involving MSD kiosks The GCIO security review identified wide-ranging and systemic IT security and privacy issues Subsequent security and privacy breaches (ACC ) in the public sector heightened the need for attention The day to day BAU environment! Is this a surprise? Understand the situation at your organisation
4 Why InfoSec Policies and Standards? Understanding the Challenges Information Security Research #1 #2 Academics Clinical UofL Donor Fund Raising Athletics Administration Requirements, Responsibilities and Expectations
5 Why InfoSec Policies and Standards? Understanding the Challenges Information Security Government Suppliers and business partners Clients, Consumers, the Public Your organisation Competitors (Opportunists) Senior Management Employees Requirements, Responsibilities and Expectations
6 Understand Why do we need InfoSec Policies and Standards? A common foundation to address and/or support Regulations, laws, requirements NZISM, PCI-DSS, contracts, GCIO mandate, Official Information Act 1982, Health Information Privacy Code 1994, Mental Health (Compulsory Assessment and Treatment) Act 1992, Intellectual Disability (Compulsory Care and Rehabilitation) Act 2003, Health Act 1956, Health and Disability Services Consumers Rights Regulations 1996, Public Records Act 2005, Privacy Act 1993, Official Information Act, other legislation/regulation Expectations Stakeholders, customers, clients, sponsors, partners/collaborators, shareholders, our constituents, media, the public Efficiency Unified approach is more effective, less confusing, easier to understand Well designed polices and standards are ultimately an enabler Numerous areas, similar requirements and expectations
7 Understand Why Policies and Standards? What is a policy? (from 1 a : prudence or wisdom in the management of affairs b : management or procedure based primarily on material interest 2 a : a definite course or method of action selected from among alternatives and in light of given conditions to guide and determine present and future decisions b : a high-level overall plan embracing the general goals and acceptable procedures especially of a governmental body UofL InfoSec: High level requirement statement or paragraph about a type of technology or behavior in the IS/IT/ICT environment.
8 Understand Why Policies and Standards? What are standards? A required approach for conducting an activity or task, utilizing a product, etc. Many times a standard is a best practice that must be followed to have a better chance of overall success. From: -and/or-? What about good enough? Descriptive requirements for a behavior based policy.
9 Understand Why Policies and Standards? Procedures: Clear steps to follow to accomplish specific tasks or behave in certain ways. Procedures should support organization, contractual, regulatory and/or statutory obligations and requirements. Examples: - Set-up a software firewall - Encrypting sensitive
10 Understand Why Policies and Standards? What good are policies? What would an organisation look like without any policies and standards? Policies and Standards: Set the foundation for compliance expectations of constituents (employees, senior management, faculty, staff, students, partners, collaborators, vendors, etc.)
11 Understand So what s the goal? UofL s objectives were: Not over restrictive An organisation with consistent, common-sense policies that: 1. Pass muster in the event of a regulatory review or audit and 2. Allow flexibility for academic, research and Support organisational strategy operational requirements 3. while supporting the required CIA (confidentiality, integrity and availability) of sensitive information.
12 Assess Establish InfoSec policies and standards for the organization What should be included? Guidance adequate to meet the organisation s risk tolerance relative to InfoSec risks (incidents, legal and regulatory exposure, lost business, PR ) To be effective, must take into account: 1. Strategic Alignment 2. Risk Assessment and Management 3. Value Delivery
13 Assess 1. Strategic Alignment Establish InfoSec policies and standards for the organization Align InfoSec with business strategy (support organisational objectives) We are in this together! Account for culture, governance style, technology, organisational structure Tone from the top - executive support!
14 Assess Establish InfoSec policies and standards for the organization 2. Risk Assessment and Management Identify InfoSec risks to the organization Understand exposure to consequences of adverse events Risk mitigation only to acceptable levels of residual risk Educate - Risk acceptance (inaction is acceptance)
15 Assess Establish InfoSec policies and standards for the organization 2. Risk Assessment and Management Sensitive Information? Sensitive information is information of a confidential or proprietary nature as well as other information that would not be routinely published for unrestricted public access or where disclosure is prohibited by laws, regulations, contractual agreements or company University policy. Sensitive information includes but is not limited to information such as medical and health records, grades and other enrollment information, credit card, bank account and other financial information, social security numbers, personal addresses, phone numbers, etc. Note: Sensitive information does not include personal information of a particular individual which that individual elects to reveal.
16 Assess Establish InfoSec policies and standards for the organization 3. Value Delivery Standard security baseline InfoSec policies, standards, procedures now aligned with business objectives and risk tolerance $ Supports InfoSec investments congruent with business objectives and risk tolerance Information Security Supports Privacy
17 Assess Establish InfoSec policies and standards for the organization 3. Value Delivery Policy and Standard Adoption BEWARE: Now we are done with that! Review Buy-in Official Adoption
18 Assess Establish InfoSec policies and standards for the organization * Sufficient mgt buy-in * Legitimacy of policy source * Adequacy of policies * Mgt understanding of trade-offs (stringent vs increased risk) * Motivation/incentive to follow policy * Encompasses relevant laws, regs, accepted practice * Adequate resources * One size fits all approach Policy Pitfalls to Beware! * Marketing, awareness, training (training attendance, user ability) * Regular review and updating * Policy compliance monitoring and auditing * Policy and business goals alignment * Underlying documentation (procedures) * On-going risk assessment to foster continued examination * Proactive vs reactive
19 Assess Where was UofL? Information Security Policies, Standards and Procedures: - Disjointed - Hap-hazard - Delineation between Policy, Standard, Procedure not always clear, not consistent - Each policy evolved organically to fit a perceived need at the time (not a structured approach)
20 Assess Information Security Policies, Standards and Procedures: - Not part of a cohesive, consistent and unified package - Not organised, no clear cohesion to policies - Hard to find Where was UofL? - Not effectively communicated to all constituents - Policies written/implemented in a manner not conducive to academic constituent support
21 Assess Where was UofL? Information Security Policies, Standards and Procedures: - Old policies DID NOT allow for the possibility of self-direction (with regards to technology) within a structured framework - Unclear and/or inconsistent sanctions - Sanction enforcement, what is that? - Unclear Senior Management Support Different InfoSec policy Approaches: General or specific Technology neutral or specific - Highly variable support within the organization
22 Act Where is UofL now? - Support from Senior Management - Received support for consistently enforced sanctions - Radical approach (for UofL) for this cohesive whole: * As technology neutral as possible Policy defines expectations for a technology but not the specific technology that must be used * Overall Policies and Standards Not written for a specific regulation (example: HIPAA) but inclusive of regulatory requirements
23 Act Policy and Standards Adoption Process Review and comments from representatives of the University Strategic Technology Executive Committee (Fall 2005) Audit Services (Winter ) InfoSec Awareness Team (Spring 2006) InfoSec Policy Review Group (Spring 2006) ATC Policy Review Subcommittee (Summer 2006) Information and Data Security Task Force (Fall 2006) General Counsel (Fall 2006) Approved! Research Deans (January 9, 2007) Council of Academic Officers (March 21, 2007) Research Compliance Committee (April 2, 2007) HSC Compliance Oversight Committee (April 19, 2007) Tier 1 Personnel (all, via , May 9, 2007) Business Advisory Group (May 18, 2007) Strategic Technology Executive Committee (June 1, 2007) Compliance Oversight Council (July 23, 2007)
24 Act Where is UofL now? Policy and Standard Framework General Accounts and Usage Computing Devices Network Services Data Centers and Facilities
25 Act Policy and Standards Overview Encryption IS PS018
26 Act Policy and Standards Overview
27 Maintain Strategy for Policy and Standards Implementation 1. Educate and Encourage Use Training Awareness Consulting 2. Improve Compliance using Consulting Auditing and Monitoring, Assessment, Adjustment Enforcement 3. Maintain Policy Relevance using Self Assessment/audit Feedback Adjustment
28 Maintain Awareness Efforts include Annual Cyber-Security Awareness Week
29
30
31 Maintain
32 Summing up UofL became An organisation with consistent, common-sense policies that: 1. Pass muster in the event of a regulatory review or audit and 2. Allow flexibility for academic, research and operational requirements 3. while supporting the required CIA (confidentiality, integrity and availability) of sensitive information.
33 Final points to ponder 1. On-going process of continuous improvement, no guarantees. 2. Diligence, education, awareness (at all levels) can provide a defensible position for compliance risk while supporting our organisations in doing their work effectively. 3. Policies and standards are a key part of this Tone from the Top Most important: Executive leadership by example 5. Training and Awareness! More important than fancy technology 6. Technology Use technology effectively, not as a substitute for #1 or #2!
34 Questions? Bruce W. Edwards CIA, CISA, CISM, CRISC Manager Audit and Assurance TAS/DHBSS
Board of Directors Meeting 12/04/2010. Operational Risk Management Charter
Board of Directors Meeting 12/04/2010 Document approved Operational Risk Management Charter Table of contents A. INTRODUCTION...3 I. Background...3 II. Purpose and Scope...3 III. Definitions...3 B. GOVERNANCE...4
A Best Practice Guide
A Best Practice Guide Contents Introduction [2] The Benefits of Implementing a Privacy Management Programme [3] Developing a Comprehensive Privacy Management Programme [3] Part A Baseline Fundamentals
VENDOR RISK MANAGEMENT UPDATE- ARE YOU AT RISK? Larry L. Llirán, CISA, CISM December 10, 2015 ISACA Puerto Rico Symposium
1 VENDOR RISK MANAGEMENT UPDATE- ARE YOU AT RISK? Larry L. Llirán, CISA, CISM December 10, 2015 ISACA Puerto Rico Symposium 2 Agenda Introduction Vendor Management what is? Available Guidance Vendor Management
www.pwc.com The data breach lifecycle: From prevention to response IAPP global privacy summit March 6, 2014 (4:30-5:30) Draft v8 2-25-14
www.pwc.com The data breach lifecycle: From prevention to response IAPP global privacy summit (4:30-5:30) Draft v8 2-25-14 Common Myths 1. You have not been hacked. 2. Cyber security is about keeping the
HIPAA and Mental Health Privacy:
HIPAA and Mental Health Privacy: What Social Workers Need to Know Presenter: Sherri Morgan, JD, MSW Associate Counsel, NASW Legal Defense Fund and Office of Ethics & Professional Review 2010 National Association
Cybersecurity for Nonprofits: How to Protect Your Organization's Data While Still Fulfilling Your Mission. June 25, 2015
Cybersecurity for Nonprofits: How to Protect Your Organization's Data While Still Fulfilling Your Mission June 25, 2015 1 Your Panelists Kenneth L. Chernof Partner, Litigation, Arnold & Porter LLP Nicholas
Compliance Policy ALCO recommended standard
1. PURPOSE In accordance with CSSF Circular 2004/155, the board of directors of [NAME OF COMPANY] (hereafter the Company ) has adopted the following Compliance Policy. The Company s Compliance function
Why you should adopt the NIST Cybersecurity Framework
www.pwc.com/cybersecurity Why you should adopt the NIST Cybersecurity Framework May 2014 The National Institute of Standards and Technology Cybersecurity Framework may be voluntary, but it offers potential
IT Vendor Due Diligence. Jennifer McGill CIA, CISA, CGEIT IT Audit Director Carolinas HealthCare System December 9, 2014
IT Vendor Due Diligence Jennifer McGill CIA, CISA, CGEIT IT Audit Director Carolinas HealthCare System December 9, 2014 Carolinas HealthCare System (CHS) Second largest not-for-profit healthcare system
HIPAA PRIVACY FOR EMPLOYERS A Comprehensive Introduction. HIPAA Privacy Regulations-General
HIPAA PRIVACY FOR EMPLOYERS A Comprehensive Introduction HIPAA Privacy Regulations-General The final HIPAA Privacy regulation was released on December 20, 2000 and was effective for compliance on April
The Legal Pitfalls of Failing to Develop Secure Cloud Services
SESSION ID: CSV-R03 The Legal Pitfalls of Failing to Develop Secure Cloud Services Cristin Goodwin Senior Attorney, Trustworthy Computing & Regulatory Affairs Microsoft Corporation Edward McNicholas Global
INFORMATION SECURITY STRATEGIC PLAN
INFORMATION SECURITY STRATEGIC PLAN UNIVERSITY OF CONNECTICUT INFORMATION SECURITY OFFICE 4/20/10 University of Connecticut / Jason Pufahl, CISSP, CISM 1 1 MISSION STATEMENT The mission of the Information
Managing Risk at Bank of America Corporation. Overview
Managing Risk at Bank of America Corporation Overview Risk is inherent in every material business activity that we undertake. Our business exposes us to strategic, credit, market, liquidity, compliance,
The New Zealand Human Services Quality Framework - ISO9002:2008 to 2012
HUMAN SERVICES QUALITY FRAMEWORK STANDARDS - POLICIES DOCUMENT Q:/1 DATE REVEIWED: REFERENCE: GOVERNANCE AND August 2014 MANAGEMENT POLICY AUTHORISATION: STANDARD REFERENCE: NEXT REVIEW DATE: Management
Pharmaceutical Compliance and Regulatory Congress 2009
Pharmaceutical Compliance and Regulatory Congress 2009 Compliance Program Elements Track I: How Program Management Can Keep You On Track Edward H. Leskauskas Director, Compliance and Ethics Operations
Standards of. Conduct. Important Phone Number for Reporting Violations
Standards of Conduct It is the policy of Security Health Plan that all its business be conducted honestly, ethically, and with integrity. Security Health Plan s relationships with members, hospitals, clinics,
Contact: Henry Torres, (870) 972-3033
Information & Technology Services Management & Security Principles & Procedures Executive Summary Contact: Henry Torres, (870) 972-3033 Background: The Security Task Force began a review of all procedures
Our Commitment to Information Security
Our Commitment to Information Security What is HIPPA? Health Insurance Portability and Accountability Act 1996 The HIPAA Privacy regulations require health care providers and organizations, as well as
Enterprise-Wide Risk Assessment
Enterprise-Wide Risk Assessment Agenda 1. Definition of risk. 2. Risk drivers in higher education today. 3. Implementing an enterprise-wide risk management (ERM) program to effectively assess, manage,
ISE Northeast Executive Forum and Awards
ISE Northeast Executive Forum and Awards October 3, 2013 Company Name: Project Name: Presenter: Presenter Title: University of Massachusetts Embracing a Security First Approach Larry Wilson Chief Information
HIPAA and HITECH Compliance for Cloud Applications
What Is HIPAA? The healthcare industry is rapidly moving towards increasing use of electronic information systems - including public and private cloud services - to provide electronic protected health
A Guide to Successfully Implementing the NIST Cybersecurity Framework. Jerry Beasley CISM and TraceSecurity Information Security Analyst
TRACESECURITY WHITE PAPER GRC Simplified... Finally. A Guide to Successfully Implementing the NIST Cybersecurity Framework Jerry Beasley CISM and TraceSecurity Information Security Analyst TRACESECURITY
Vendor Management: An Enterprise-wide Focus. Susan Orr, CISA CISM CRISC CRP Susan Orr Consulting, Ltd.
Vendor Management: An Enterprise-wide Focus Susan Orr, CISA CISM CRISC CRP Susan Orr Consulting, Ltd. Why Focus on Vendor Management Increased financial regulatory scrutiny GLBA and Identity Theft Red
VENDOR MANAGEMENT. General Overview
VENDOR MANAGEMENT General Overview With many organizations outsourcing services to other third-party entities, the issue of vendor management has become a noted topic in today s business world. Vendor
Fraud Prevention and Deterrence
Fraud Prevention and Deterrence Fraud Risk Assessment 2016 Association of Certified Fraud Examiners, Inc. What Is Fraud Risk? The vulnerability that an organization faces from individuals capable of combining
The Changing IT Risk Landscape Understanding and managing existing and emerging risks
The Changing IT Risk Landscape Understanding and managing existing and emerging risks IIA @ Noon Kareem Sadek Senior Manager, Deloitte Canada Chris Close Senior Manager, Deloitte Canada December 2, 2015
Audit, Risk Management and Compliance Committee Charter
Audit, Risk Management and Compliance Committee Charter Woolworths Limited Adopted by the Board on 27 August 2013 page 1 1 Introduction This Charter sets out the responsibilities, structure and composition
Cyber Risks in the Boardroom
Cyber Risks in the Boardroom Managing Business, Legal and Reputational Risks Perspectives for Directors and Executive Officers Preparing Your Company to Identify, Mitigate and Respond to Risks in a Changing
fs viewpoint www.pwc.com/fsi
fs viewpoint www.pwc.com/fsi June 2013 02 11 16 21 24 Point of view Competitive intelligence A framework for response How PwC can help Appendix It takes two to tango: Managing technology risk is now a
APPLICATION OF KING III CORPORATE GOVERNANCE PRINCIPLES 2014
WOOLWORTHS HOLDINGS LIMITED CORPORATE GOVERNANCE PRINCIPLES 2014 CORPORATE GOVERNANCE PRINCIPLES 2014 CORPORATE GOVERNANCE PRINCIPLES 2014 This table is a useful reference to each of the King III principles
BOARD OF DIRECTORS MANDATE
BOARD OF DIRECTORS MANDATE Board approved: May 7, 2014 This mandate provides the terms of reference for the Boards of Directors (each a Board ) of each of Economical Mutual Insurance Company ( Economical
CISM (Certified Information Security Manager) Document version: 6.28.11
CISM (Certified Information Security Manager) Document version: 6.28.11 Important Note About CISM PDF techexams CISM PDF is a comprehensive compilation of questions and answers that have been developed
Citation for published version (APA): Berthing, H. H. (2014). Vision for IT Audit 2020. Abstract from Nordic ISACA Conference 2014, Oslo, Norway.
Aalborg Universitet Vision for IT Audit 2020 Berthing, Hans Henrik Aabenhus Publication date: 2014 Document Version Early version, also known as pre-print Link to publication from Aalborg University Citation
Question: 1 Which of the following should be the FIRST step in developing an information security plan?
1 ISACA - CISM Certified Information Security Manager Exam Set: 1, INFORMATION SECURITY GOVERNANCE Question: 1 Which of the following should be the FIRST step in developing an information security plan?
Information Security ISO Standards. Feb 11, 2015. Glen Bruce Director, Enterprise Risk Security & Privacy
Information Security ISO Standards Feb 11, 2015 Glen Bruce Director, Enterprise Risk Security & Privacy Agenda 1. Introduction Information security risks and requirements 2. Information Security Management
MANUAL OF UNIVERSITY POLICIES PROCEDURES AND GUIDELINES. Applies to: faculty staff students student employees visitors contractors
Page 1 of 5 Applies to: faculty staff students student employees visitors contractors Effective Date of This Revision: October 19, 2006 Contact for More Information: Chief Privacy Officer 1303 A West Campus
INDIANA UNIVERSITY SCHOOL OF OPTOMETRY HIPAA COMPLIANCE PLAN TABLE OF CONTENTS. I. Introduction 2. II. Definitions 3
INDIANA UNIVERSITY SCHOOL OF OPTOMETRY HIPAA COMPLIANCE PLAN TABLE OF CONTENTS I. Introduction 2 II. Definitions 3 III. Program Oversight and Responsibilities 4 A. Structure B. Compliance Committee C.
HITRUST CSF Assurance Program You Need a HITRUST CSF Assessment Now What?
HITRUST CSF Assurance Program You Need a HITRUST CSF Assessment Now What? Introduction This material is designed to answer some of the commonly asked questions by business associates and other organizations
RISK AND COMPLIANCE COMMITTEE CHARTER
1. GENERAL SCOPE AND AUTHORITY 1.1 Introduction This charter governs the operations of the Risk & Compliance Committee of Redflex Holdings Limited (RHL or Company). 1.2 Purpose The Risk & Compliance Committee
PRINCIPLES ON OUTSOURCING OF FINANCIAL SERVICES FOR MARKET INTERMEDIARIES
PRINCIPLES ON OUTSOURCING OF FINANCIAL SERVICES FOR MARKET INTERMEDIARIES TECHNICAL COMMITTEE OF THE INTERNATIONAL ORGANIZATION OF SECURITIES COMMISSIONS FEBRUARY 2005 Preamble The IOSCO Technical Committee
BUSINESS PRINCIPLES FOR COUNTERING BRIBERY A MULTI-STAKEHOLDER INITIATIVE LED BY TRANSPARENCY INTERNATIONAL
BUSINESS PRINCIPLES FOR COUNTERING BRIBERY A MULTI-STAKEHOLDER INITIATIVE LED BY TRANSPARENCY INTERNATIONAL Transparency International is the global civil society organisation leading the fight against
Risk Assessment & Enterprise Risk Management
Risk Assessment & Enterprise Risk 1 Healthcare Corporate Governance Today s environment requires building a culture of risk awareness and management of risk across the organization, while formulating less
ASTRAZENECA GLOBAL POLICY SAFEGUARDING COMPANY ASSETS AND RESOURCES
ASTRAZENECA GLOBAL POLICY SAFEGUARDING COMPANY ASSETS AND RESOURCES THIS POLICY SETS OUT THE REQUIREMENTS FOR SAFEGUARDING COMPANY ASSETS AND RESOURCES TO PROTECT PATIENTS, STAFF, PRODUCTS, PROPERTY AND
University of Sunderland Business Assurance Information Security Policy
University of Sunderland Business Assurance Information Security Policy Document Classification: Public Policy Reference Central Register Policy Reference Faculty / Service IG 003 Policy Owner Assistant
SUMMARY OF POSITION ROLE/RESPONSIBILITIES:
SUMMARY OF POSITION ROLE/RESPONSIBILITIES: Reporting to the Senior Vice President for Administration, this position is responsible for ensuring that the University of Florida, in its entirety, is compliant
Breaking Down the Silos: A 21st Century Approach to Information Governance. May 2015
Breaking Down the Silos: A 21st Century Approach to Information Governance May 2015 Introduction With the spotlight on data breaches and privacy, organizations are increasing their focus on information
Framework for Enterprise Risk Management
Framework for Enterprise Risk Management 2013 Johnson & Johnson Contents Introduction.... 4 J&J Strategic Framework... 5 What is Risk?.......................................................... 7 J&J Approach
INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE OF INTERNAL AUDITING (STANDARDS)
INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE OF INTERNAL AUDITING (STANDARDS) Introduction to the International Standards Internal auditing is conducted in diverse legal and cultural environments;
INSTITUTIONAL COMPLIANCE PLAN
INSTITUTIONAL COMPLIANCE PLAN Responsible Party: Board of Trustees Contact: Institutional Compliance Office Original Effective Date: 02/16/2012 Last Revised Date: 10/13/2014 Contents I. SCOPE OF THE PLAN...
MISSION VALUES. The guide has been printed by:
www.cudgc.sk.ca MISSION We instill public confidence in Saskatchewan credit unions by guaranteeing deposits. As the primary prudential and solvency regulator, we promote responsible governance by credit
3 August 2012 Policy updated to reflect name changes and alignment with current Aurora Energy Group Policy standards.
Aurora Energy Risk Management Policy Version History REV NO. DATE REVISION DESCRIPTION APPROVAL 0 19/11/98 Risk Management Policy Prepared by: Manager Internal Audit 1 March 2007 Risk Management Policy
Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION
Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION The purpose of this policy is to outline essential roles and responsibilities within the University community for
How To Write A Risk Management Policy For The University Of Kerry
Risk Management Policy Originator name: Department: Implementation date: Ruth Anderson Finance 1 August 2013 Date of next review: 1 August 2016 Related policies: Health & Safety Policy, Equality & Diversity
How To Manage Information Security At A University
Data Management & Protection: Roles & Responsibilities Document Version: 1.0 Effective Date: December, 2008 Original Issue Date: December, 2008 Most Recent Revision Date: November 29, 2011 Approval Authority:
How To Ensure Health Information Is Protected
pic pic CIHI Submission: 2011 Prescribed Entity Review October 2011 Who We Are Established in 1994, CIHI is an independent, not-for-profit corporation that provides essential information on Canada s health
Preventing Fraud: Assessing the Fraud Risk Management Capabilities of Today s Largest Organizations
Preventing Fraud: Assessing the Fraud Risk Management Capabilities of Today s Largest Organizations Overview In late 2006 and 2007, Protiviti commissioned a study to gauge the fraud risk management (FRM)
Standards for the Professional Practice of Internal Auditing
Standards for the Professional Practice of Internal Auditing THE INSTITUTE OF INTERNAL AUDITORS 247 Maitland Avenue Altamonte Springs, Florida 32701-4201 Copyright c 2001 by The Institute of Internal Auditors,
Audit and Risk Committee Charter. 1. Membership of the Committee. 2. Administrative matters
Audit and Risk Committee Charter The Audit and Risk Committee (the Committee ) is a Committee of the Board established with the specific powers delegated to it under Clause 8.15 of the Company s Constitution
Health Sciences Compliance Plan
INDIANA UNIVERSITY Health Sciences Compliance Plan 12.18.2014 approved by University Clinical Affairs Council Table of Contents Health Sciences Compliance Plan I. INTRODUCTION... 2 II. SCOPE... 2 III.
Board means the Board of Directors of each of Scentre Group Limited, Scentre Management Limited, RE1 Limited and RE2 Limited.
Board Charter SCENTRE GROUP LIMITED ABN 66 001 671 496 SCENTRE MANAGEMENT LIMITED ABN 41 001 670 579 AFS Licence No: 230329 as responsible entity of Scentre Group Trust 1 ABN 55 191 750 378 ARSN 090 849
University of Rhode Island IT Governance
University of Rhode Island IT Governance The Information Technology Review Steering Committee invites you to comment on a proposed IT governance structure for the University. The proposal is based on recommendations
Avondale College Limited Enterprise Risk Management Framework 2014 2017
Avondale College Limited Enterprise Risk Management Framework 2014 2017 President s message Risk management is part of our daily life, something we do regularly; often without realising we are doing it.
APPLICATION OF THE KING III REPORT ON CORPORATE GOVERNANCE PRINCIPLES
APPLICATION OF THE KING III REPORT ON CORPORATE GOVERNANCE PRINCIPLES Ethical Leadership and Corporate Citizenship The board should provide effective leadership based on ethical foundation. that the company
Cybersecurity. Considerations for the audit committee
Cybersecurity Considerations for the audit committee Insights on November 2012 governance, risk and compliance Fighting to close the gap Ernst & Young s 2012 Global Information Security Survey 2012 Global
Anti-Money Laundering controls in Mergers & Acquisitions
White Paper Anti-Money Laundering controls in Mergers & Acquisitions June 2014 Anti-Money Laundering controls in Mergers & Acquisitions Authors: Ana L. Pereira and Ana Maria H. de Alba Caveat emptor let
Practice Guide COORDINATING RISK MANAGEMENT AND ASSURANCE
Practice Guide COORDINATING RISK MANAGEMENT AND ASSURANCE March 2012 Table of Contents Executive Summary... 1 Introduction... 1 Risk Management and Assurance (Assurance Services)... 1 Assurance Framework...
From Information Management to Information Governance: The New Paradigm
From Information Management to Information Governance: The New Paradigm By: Laurie Fischer Overview The explosive growth of information presents management challenges to every organization today. Retaining
U.S. CORPORATE ETHICS AND COMPLIANCE POLICY
U.S. CORPORATE ETHICS AND COMPLIANCE POLICY Table of Contents Page 1. Letter from the President & CEO 3 2. Introduction 4 3. How to Handle and Report Ethical and/or Compliance Issues 5 3.1 Violations of
ADMINISTRATIVE POLICY # 32 8 2 (2014) Information Security Roles and Responsibilities
Policy Title: Information Security Roles Policy Type: Administrative Policy Number: ADMINISTRATIVE POLICY # 32 8 2 (2014) Information Security Roles Approval Date: 05/28/2014 Revised Responsible Office:
Board Charter. HCF Life Insurance Company Pty Ltd (ACN 001 831 250) (the Company )
Board Charter HCF Life Insurance Company Pty Ltd (ACN 001 831 250) (the Company ) Board approval date: 27 October 2015 Contents 1. Introduction and Purpose of this Charter...1 2. Role of the Board...1
Navigating the NIST Cybersecurity Framework
Navigating the NIST Cybersecurity Framework Explore the NIST Cybersecurity Framework and tools and processes needed for successful implementation. Abstract For federal agencies, addressing cybersecurity
Feature. Developing an Information Security and Risk Management Strategy
Feature Developing an Information Security and Risk Management Strategy John P. Pironti, CISA, CISM, CGEIT, CISSP, ISSAP, ISSMP, is the president of IP Architects LLC. He has designed and implemented enterprisewide
CHARTER OF THE BOARD OF DIRECTORS
SUN LIFE FINANCIAL INC. CHARTER OF THE BOARD OF DIRECTORS This Charter sets out: 1. The duties and responsibilities of the Board of Directors (the Board ); 2. The position description for Directors; 3.
Information Security Program
Stephen F. Austin State University Information Security Program Revised: September 2014 2014 Table of Contents Overview... 1 Introduction... 1 Purpose... 1 Authority... 2 Scope... 2 Information Security
Mobile App Developer Agreements
Mobile App Developer Agreements By Alan L. Friel Many companies that have had disputes with developers have been surprised to discover that the agreements signed, often without input from legal, failed
Sarbanes-Oxley Control Transformation Through Automation
Sarbanes-Oxley Control Transformation Through Automation An Executive White Paper By BLUE LANCE, Inc. Where have we been? Where are we going? BLUE LANCE INC. www.bluelance.com 713.255.4800 [email protected]
UC PRIVACY AND INFORMATION SECURITY STEERING COMMITTEE OCTOBER 25, 2010
UC PRIVACY AND INFORMATION SECURITY STEERING COMMITTEE OCTOBER 25, 2010 Agenda 1:00 pm Welcome Introductions Review of the Committee s Charge A Provisional 18-Month Plan 1:30 Setting the Stage Privacy
www.pwc.com Third Party Risk Management 12 April 2012
www.pwc.com Third Party Risk Management 12 April 2012 Agenda 1. Introductions 2. Drivers of Increased Focus on Third Parties 3. Governance 4. Third Party Risks and Scope 5. Third Party Risk Profiling 6.
Issue 1.0. UoG/ILS/IS 001. Information Security and Assurance Policy. Information Security and Compliance Manager
Document Reference Number Date Title Author Owning Department Version Approval Date Review Date Approving Body UoG/ILS/IS 001 January 2016 Information Security and Assurance Policy Information Security
Conflicts of Interest Policy
Conflicts of Interest Policy Novartis Global Policy September 1, 2015 Version GIC 101.V1.EN Introduction 1.1 Purpose Novartis is committed to conducting business in a manner that ensures Associates business
The Cybersecurity Journey How to Begin an Integrated Cybersecurity Program. Version 1.0 March 2005
The Cybersecurity Journey How to Begin an Integrated Cybersecurity Program March 2005 Legal and Copyright Notice The Chemical Industry Data Exchange (CIDX) is a nonprofit corporation, incorporated in the
Generally Accepted Recordkeeping Principles
Generally Accepted Recordkeeping Principles Information Governance Maturity Model Information is one of the most vital strategic assets any organization possesses. Organizations depend on information to
State of Minnesota. Enterprise Security Strategic Plan. Fiscal Years 2009 2013
State of Minnesota Enterprise Security Strategic Plan Fiscal Years 2009 2013 Jointly Prepared By: Office of Enterprise Technology - Enterprise Security Office Members of the Information Security Council
GUIDANCE FOR MANAGING THIRD-PARTY RISK
GUIDANCE FOR MANAGING THIRD-PARTY RISK Introduction An institution s board of directors and senior management are ultimately responsible for managing activities conducted through third-party relationships,
Information Protection Framework: Data Security Compliance and Today s Healthcare Industry
Information Protection Framework: Data Security Compliance and Today s Healthcare Industry Executive Summary Today s Healthcare industry is facing complex privacy and data security requirements. The movement
Who Should Know This Policy 2 Definitions 2 Contacts 3 Procedures 3 Forms 5 Related Documents 5 Revision History 5 FAQs 5
Information Security Policy Type: Administrative Responsible Office: Office of Technology Services Initial Policy Approved: 09/30/2009 Current Revision Approved: 08/10/2015 Policy Statement and Purpose
Corporate policy statement on ethical business practices of BCD Travel
Corporate policy statement on ethical business practices of BCD Travel 1. Statement of policy It is a fundamental policy of the company to conduct its business with honesty and integrity and in accordance
Information Security Plan May 24, 2011
Information Security Plan May 24, 2011 REVISION CONTROL Document Title: Author: HSU Information Security Plan John McBrearty Revision History Revision Date Revised By Summary of Revisions Sections Revised