Security Manual Template Policy and Procedure Manual Compliance Management Made Easy ISO / HIPAA / SOX / CobiT / FIPS 199 Compliant

Transcription

1 Brochure More information from Security Manual Template Policy and Procedure Manual Compliance Management Made Easy ISO / HIPAA / SOX / CobiT / FIPS 199 Compliant Description: Supports Meaningful Use Compliant Stage Implementation Many organizations fail to realize the benefits of security information management due to the often exhaustive financial and human resource costs of implementing and maintaining the software. However, the Security Manual Template the industry standard provides the infrastructure tools to manage security, make smarter security decisions and respond faster to security incidents and compliance requests within days of implementation. The template provides a framework for evaluating SIM services and shows how they could be applied within your organization.security Manual Security incidents are rising at an alarming rate every year. As the complexity of the threats increases, so do the security measures required to protect networks and critical enterprise data. CIOs, Data center operators, network administrators, and other IT professionals need to comprehend the basics of security in order to safely deploy and manage data and networks. Securing a typical business network and IT infrastructure demands an end-to-end approach with a firm grasp of vulnerabilities and associated protective measures. While such knowledge cannot stop all attempts at network incursion or system attack, it can empower IT professionals to eliminate general problems, greatly reduce potential damages, and quickly detect breaches. With the ever-increasing number and complexity of attacks, vigilant approaches to security in both large and small enterprises are a must. The Security Manual Template meets that requirement. Security Manual - Comprehensive, Detailed, and Customizable The Security Manual is over 240 pages in length. All versions of the Security Manual Template include both the Business IT Impact Questionnaire and the Threat Vulnerability Assessment Tool (they were redesigned to address Sarbanes Oxley compliance). n addition, the Security Manual Template PREMIUM Edition contains 16 detail job descriptions that apply specifically to security and Sarbanes Oxley, ISO security domains, ISO (ISO27001 and ISO27002), PCI- DSS, HIPAA, FIPS 199, and CobiT. The Security Manual has recommended policies, procedures and written agreements with employees, vendors and other parties who have access to the company s technology assets. To make this process as easy as possible, the author provides 18 formatted electronic forms for distribution and documentation. All forms are in easy-to-edit Microsoft Word templates so all you need to do is add your corporate logo, make your own additions and changes and your task of policy and procedure documentation is nearly complete! The ELECTRONIC forms included with the Security Manual template are: - Blog Policy Compliance Agreement - BYOD Access and Use Agreement - Company Asset Employee Control Log - Employee Agreement - Employee Termination Procedures and Checklist - FIPS 199 Assessment - Internet Access Request Form - Internet and Electronic Communication Employee Agreement - Internet use Approval - Mobile Device Access and Use Agreement - Mobile Device Security and Compliance Checklist - New Employee Security Acknowledgment and Release - Outsourcing and Cloud Security Compliance Agreement - Outsourcing Security Compliance Agreement

2 - Preliminary Security Audit Checklist - Risk Assessment - Security Access Application - Security Audit Report - Security Violation Procedures - Sensitive Information Policy Compliance Agreement - Server Registration - Social networking Policy Compliance Agreement - Telecommuting Work Agreement - Text Messaging Sensitive Information Agreement - Threat and Vulnerability Assessment Inventory Data Security and Protection are a priority and this template is a must have tool for every CIO and IT department. Over 3,000 enterprise worldwide have acquired this tool and it is viewed by many as the Industry Standard for Security Management and Security Compliance. The Security Manual Template - ISO compliant is provided in Word. Included also are the Business Impact questionnaire (Word) and a Threat and Vulnerability Assessment Form (PDF and Excel). It is a complete Security Manual and can be used in whole or in part to comply with Sarbanes Oxley, define responsibilities, actions and procedures to manage the security of your computer, communication, Internet and network environment. As a bonus you get 25 ELECTRONIC FORMS that will help you implement the policies and procedures in this electronic document. Contents: Security - Introduction - Scope - Objective - Applicability - Best Practices - Best Practices When Implementing Security Policies and Procedures - Best Practices Network Security Management - Best Practices to Meet Compliance Requirements - Best Practices to Manage Compliance Violations - Best Practice Data Destruction and Retention - Web Site Security Flaws - ISO Compliance Process - Security General Policy - General Management - Individual Managers and Staff Members - Principles of Least Privilege and Need-To-Know - Sensitivity and Criticality of Information and Applications - Critical Applications - Sensitive Information and Applications - Safeguarding Resources - Safeguarding Resources Traveling or at Off-Site Facility - Security Risk Analysis Program - Processing Area Risk Categories - Sensitive Staff Member Positions - Security Design and Procurement Specifications - Software Security - Hardware Security - Network Security - Logical Access Controls - Software Development Controls - Manager, Internet and Information Technology Group - Manager, Financial Management & Control Department - Security Committee (SC) - Manager, Internet and Information Technology Security - All Enterprise Managers (Enterprise Groups, Departments and Divisions) - Security Representative

3 - Enterprise Staff Members Minimum and Mandated Security Standard Requirements - Best Practices to Meet Compliance Requirements - Best Practices to Manage Compliance Violations - Best Data Destruction and Retention Practices - What Google Knows - Internet Security Myths Vulnerability Analysis and Threat Assessment - Threat and Vulnerability Assessment Tool - Evaluate Risk Risk Analysis IT Applications and Functions - Objective - Roles and Responsibilities - Program Requirements - Frequency - Relationship to Effective Security Design - Selection of Safeguards - Requests for Waiver - Program Basic Elements Staff Member Roles - Basic Policies - Security - Determining Sensitive Internet and Information Technology Systems Positions - Personnel Practices - Education and Training - Contractor Personnel Physical Security - Information Processing Area Classification - Classification Categories - Access Control - Levels of Access Authority - Access Control Requirements by Category - Implementation Requirements - Protection of Supporting Utilities Facility Design, Construction and Operational Considerations - Building Location - External Characteristics - Location of Information Processing Areas - Construction Standards - Water Damage Protection - Air Conditioning - Entrances and Exits - Interior Furnishings - Fire - Electrical - Air Conditioning - Remote Internet and Information Technology Workstations - Lost Equipment - Training, Drills, Maintenance and Testing Media and Documentation - Data Storage and Media Protection - Documentation Data and Software Security - Resources to Be Protected - Classification

4 - Rights - Access Control - Internet / Intranet / Terminal Access / Wireless Access - Spyware - Wireless Security Standards - Logging and Audit Trail Requirements - Satisfactory Compliance - Violation Reporting and Follow-Up Physical and Virtual File Server Security Policy Purpose Statement - Applicability - Terms and Definitions - Server Requirements - Server Configuration Guidelines Network Security - Vulnerabilities - Exploitation Techniques - Goal - Resource Protection - Configuration Management - Dial-Up Controls - Message Authentication - Encryption - Network Contingency Planning Sensitive Information Policy - Credit Card, Social Security, Employee, and Customer Data - PCI - HIPAA - Gramm-Leach-Bliley (Financial Services Modernization Act of California SB 1386 Personal Information Privacy - Massachusetts 201 CMR Data Protection Requirements - Secure Network Standards - Install and Maintain a Network Configuration Which Protects Data - Wireless & VPN - Modify Vendor Defaults - Protect Sensitive Data - Protect Encryption Keys, User IDs, and Passwords - Protect Development and Maintenance of Secure Systems and Applications - Manage User IDs to Meet Security Requirements - Restrict Physical Access to Secure Data Paper and Electronic Files - Regularly Monitor and Test Networks - Test Security Systems and Processes - Retention Compliance - to be printed - Regulations and Industry Impact - Keys to Archiving Compliance - Privacy Guidelines - Best Practices Internet and Information Technology Contingency Planning - Manager, Internet and Information Technology Group - Manager, Financial Management & Control Department - Managers, Information Processing Areas - Manager, Contingency Planning - Managers, All Departments - User Organizations

5 - Information Technology - Disaster Recovery Planning. - Contingency Planning - Development Activities - Documentation - Contingency Plan Activation and Recovery - Disaster Recovery / Business Continuity and Security Basics - Servers - Network - Clients - Recovery Procedures - Communication - Designated operators - Designated manager - External resources - Insurance Insurance Requirements - Objectives - Filing a Proof of Loss - Risk Analysis Program - Purchased Equipment and Systems - Leased Equipment and Systems - Media - Business Interruption - Staff Member Dishonesty - Errors and Omissions Outsourced Services - Managers, All Departments, Internet and Information Technology Group - Managers, All Other ENTERPRISE Departments - Internet and Information Technology Systems Contract Personnel and Organizations - Manager, Internet and Information Technology Contracts/Hardware Services Division - Internet and Information Technology Security Group - Manager, Audit Department - Outside Service Providers Including Cloud - Contract Terms and Operating Policies Travel and Off-Site Meeting Special Considerations - Laptop and PDA Security - Wireless & VPN - Maximize Data and Application Security - Minimize Attention - Carefully Use Shared Resources - Off-Site Meeting Special Considerations Waiver Procedures - Purpose and Scope - Definition - Procedure Incident Reporting Procedure - Purpose & Scope - Definitions - Procedure - Analysis/Evaluation Access Control Guidelines

6 - Purpose & Scope - Objectives - Definitions of Access Control Zones - Badge Issuance Internet, , and Electronic Communication - Overview - Appropriate use of Equipment - Internet Access - Electronic Mail - Retention of on Personal Systems - Forwarding Outside of ENTERPRISE - and Business Records Retention - Copyrighted Materials - Ownership of Information - Security - Internet and Electronic Communication Policy - Personal Responsibility - Term of Permitted Use - Purpose and Use - Network Etiquette - Banned Activities - Confidential Information - Privacy - Noncompliance is for Business Use - Employees Have No Reasonable Expectation of Privacy - Offensive Content and Harassing or Discriminatory Activities Are Banned - Confidential, Proprietary, and Personal Information Must Be Protected - Do Not Use to Communicate with Lawyers - Business Record Retention - Violations Blog and Personal Web Sites Policy - Rights to content - Personal Website and Blog Guidelines Non ENTERPRISE domains - Security Standards Mobile Access and Use Policy - Overview Processes, Forms, and Checklists - Security Violation Reporting - Security Audit Report Form - Preliminary Audit Security Checklist - New Employee Security Acknowledgement and Release - Internet & Electronic Communication - Employee Acknowledgment - - Employee Acknowledgment - Internet Use Approval - Internet Access Request - Security Access Application Form - Blog Policy Compliance Agreement BYOD Access and Use Agreement Form - Mobile Device Access and Use Agreement - Company Asset Employee Control Log - Employee Termination Process

7 Supporting Materials - Security Management Compliance Checklist & Process Definition - Preventive Controls - Detective & Corrective Controls - Control Validation - Massachusetts 201 CMR 17 Compliance Checklist - The Comprehensive Written Information Security Program (WISP) - Additional Requirements for Electronic Records - HIPAA Audit Program Guide - Background - Ensuring HIPAA Compliance - Planning the Audit - HIPAA Audit Scope - ISO Security Process Audit Checklist - Security Policy Management Objectives - Corporate Security Management Objectives - Organizational Asset Management Objectives - Human Resource Security Management Objectives - Physical and Environmental Security Management Objectives - Communications and Operations Management Objectives - Information Access Control Management Objectives - Systems Development and Maintenance Objectives - Information Security Incident Management Objectives - DRP and Business Continuity Management Objectives - Compliance Management Objectives - Firewall Security Requirements - Firewall Security Policy Checklist - BYOD and Mobile Content Best of Breed Security Checklist - 1. Business and IT Impact Questionnaire - 2. Threat and Vulnerability Assessment Tool - 3. Sarbanes-Oxley Section 404 Check List Excel Spreadsheet Revision History Ordering: Order Online - Order by Fax - using the form below Order by Post - print the order form below and send to Research and Markets, Guinness Centre, Taylors Lane, Dublin 8, Ireland.

8 Page 1 of 2 Fax Order Form To place an order via fax simply print this form, fill in the information below and fax the completed form to (from USA) or (from Rest of World). If you have any questions please visit Order Information Please verify that the product information is correct. Product Name: Web Address: Office Code: Security Manual Template Policy and Procedure Manual Compliance Management Made Easy ISO / HIPAA / SOX / CobiT / FIPS 199 Compliant SC Product Format Please select the product format and quantity you require: Electronic (Word) - Single User: Quantity USD 529 Contact Information Please enter all the information below in BLOCK CAPITALS Title: Mr Mrs Dr Miss Ms Prof First Name: Last Name: Address: * Job Title: Organisation: Address: City: Postal / Zip Code: Country: Phone Number: Fax Number: * Please refrain from using free accounts when ordering (e.g. Yahoo, Hotmail, AOL)

9 Page 2 of 2 Payment Information Please indicate the payment method you would like to use by selecting the appropriate box. Pay by credit card: You will receive an with a link to a secure webpage to enter your credit card details. Pay by check: Please post the check, accompanied by this form, to: Research and Markets, Guinness Center, Taylors Lane, Dublin 8, Ireland. Pay by wire transfer: Please transfer funds to: Account number Sort code Swift code IBAN number Bank Address ULSBIE2D IE78ULSB Ulster Bank, Main Street, Blackrock, Co. Dublin, Ireland. If you have a Marketing Code please enter it below: Marketing Code: Please note that by ordering from Research and Markets you are agreeing to our Terms and Conditions at Please fax this form to: (646) or (646) From USA or From Rest of World