IT Infrastructure, Strategy, and Charter Template: ISO Series Compliant - SOX, HIPAA and PCI-DSS Compliant

Transcription

1 Brochure More information from IT Infrastructure, Strategy, and Charter Template: ISO Series Compliant - SOX, HIPAA and PCI-DSS Compliant Description: With the explosion of technology into every facet of the day-to-day business environment there is a need to define an effective infrastructure to support operating environment; have a strategy for the deployment and technology; and clearly define responsibilities and accountabilities for the use and application of technology. The size of enterprise impacts the cost of IT as percentage of revenue is greatest in small enterprise (less than $100 million in revenue) and lest in large enterprises, those with reveenuses over $1 billion. Also infrastructure and budet vary by industry. The template comes as both a WORD document utilizing a CSS style sheet that is easily modifiable. Included with the template are a HIPAA Audit Program Guide and an ISO and ISO Security Process Audit Checklist. The Template is over 125 pages in length and the topics covered include: - IT Infrastructure, Strategy, and Charter Summary - Statement of Authority - IT Management Structure - Compliance - Personnel Practices - Controls - Application Development Standards - Service Requests - Local Area Network - Back-up and Recovery - Disaster Recovery Plan - Security - Access Control - Physical Site - Access Control - Software and Data - Facility Requirements - ISO & ISO Audit Checklist - HIPAA Audit Program - Full Job Description for CIO large enterprise - Full Job Description for CIO small enterprise - Security Management Checklist - Massachusetts 201 CMR 17 Compliance Checklist Contents: IT INFRASTRUCTURE, STRATEGY, AND CHARTER SUMMARY Benefits of IT Infrastructure Management Base Assumptions and Objectives Scope and Applicability Operating Philosophy Compliance International Organization for Standardization ISO STRATEGY AND CHARTER STATEMENT OF AUTHORITY Chief Information Officer (CIO) Authority Functional IT Group Heads Authority IT Management Council

2 Authority Users IT MANAGEMENT STRUCTURE Organizational Approach [Enterprise] IT Group [Enterprise] IT Resources Functional IT Groups COMPLIANCE Objective CIO IT Management Council Functional IT Heads Users Auditors PERSONNEL PRACTICES Formal Job Descriptions Job Description Format Hiring Termination Voluntary Termination Job Abandonment Involuntary Termination Termination Actions Training ERP AND OMNI COMMERCE Strategy Top 10 Best Practices for Omni Commerce Implementation CONTROLS Types of Controls Risks Types of Risk Controls Standards Logging and Audit Trails APPLICATION DEVELOPMENT STANDARDS SAMMY Quality Assurance Process SERVICE REQUESTS Policies Process Service Request Management Equipment/Service Request Problem Resolution Process LOCAL AREA NETWORKS (LANS) Features LAN Standards LAN Councils and Workgroups BACK-UP & RECOVERY Data Storage and Media Protection Labeling Storage Retention Schedule Disposal of Sensitive Information Back-up Program and Schedule

3 Creating a Back-up Program Monitoring the Back-up Program Recovering From Back-up Media DISASTER RECOVERY PLAN Description Critical Function Analysis DRP Procedures for Critical Data Back-up Criteria Back-up Procedures Storage Criteria Business Recovery Procedures Requirements for Recovery Recovery Guidelines Restoring Damaged Equipment Recovery Management Contingency Planning Planning Activities Function of Planning Activities Development Activities Planning Manual Maintenance Activities SECURITY IT Processing Area Classification Criteria Classification Categories Physical Security Work Stations and Remote Terminals Attended terminals Unattended terminals Systems Security Management Control Tools Staff Member Security Review Risky Practices Violations Management Action User Sensitive Positions Network Security Vulnerabilities Violation Reporting and Follow-Up Violation Logging ACCESS CONTROL - PHYSICAL SITE Separation of Duties Least Privilege Access Areas Individual Accountability Category I - IT Processing Areas Category II - IT Processing Areas Category III - IT Processing Areas Category IV IT Processing Areas Definitions of IT Access Control Zones Public Areas Controlled Areas Badges Permanent Badge/Permanent Staff Member Permanent Badge/Temporary Staff Member

4 Temporary Badge/Permanent Staff Temporary Badge/Temporary Staff Member Temporary Badge/Non-staff Members (Visitors and Vendors) Access Control Methods Levels of Access Authority Permanent Access Temporary Access Protection of Supporting Utilities Resource Protection Network Control Centers Network Components Wire Closets Terminal and Remote Job Entry Devices Configuration Management Dial-Up Controls Message Authentication Exceptions ACCESS CONTROL - SOFTWARE AND DATA Resources to Be Protected Basic Standards Classification Of Data, Software And Documentation Control Types Access from Other Facilities Controllability Integrity Identification Authentication Classification of Techniques Standards for Passwords Authorization Verification FACILITY REQUIREMENTS Physical Plan Considerations Building Location External Characteristics Location of IT Processing Areas Construction Standards Protection from Water Damage Air Conditioning Entrances and Exits Interior Furnishings Fire Power Air Conditioning OTHER TECHNICAL GUIDES APPENDIX HIPAA Audit Program Guide Background Ensuring HIPAA Compliance Planning the Audit HIPAA Audit Scope ISO & Security Process Audit Checklist Security Policy Management Objectives Corporate Security Management Objectives Organizational Asset Management Objectives Human Resource Security Management Objectives Physical and Environmental Security Management Objectives Communications and Operations Management Objectives Information Access Control Management Objectives Systems Development and Maintenance Objectives

5 Information Security Incident Management Objectives DRP and Business Continuity Management Objectives Compliance Management Objectives CIO Job Description Position Purpose Problems and Challenges Essential Position Functions Contacts Position Requirements Chief Information Officer (CIO) Small Enterprise Position Purpose Problems and Challenges Essential Position Functions Contacts Position Requirements Security Management Compliance Checklist Policy & Process Definition Preventive Controls Detective & Corrective Controls Control Validation Massachusetts 201 CMR 17 Compliance Checklist The Comprehensive Written Information Security Program (WISP) Additional Requirements for Electronic Records WHAT S NEWS Ordering: Order Online - Order by Fax - using the form below Order by Post - print the order form below and send to Research and Markets, Guinness Centre, Taylors Lane, Dublin 8, Ireland.

6 Page 1 of 2 Fax Order Form To place an order via fax simply print this form, fill in the information below and fax the completed form to (from USA) or (from Rest of World). If you have any questions please visit Order Information Please verify that the product information is correct. Product Name: Web Address: Office Code: IT Infrastructure, Strategy, and Charter Template: ISO Series Compliant - SOX, HIPAA and PCI-DSS Compliant SC Product Format Please select the product format and quantity you require: Electronic (Word) - Single User: Quantity USD 529 Contact Information Please enter all the information below in BLOCK CAPITALS Title: Mr Mrs Dr Miss Ms Prof First Name: Last Name: Address: * Job Title: Organisation: Address: City: Postal / Zip Code: Country: Phone Number: Fax Number: * Please refrain from using free accounts when ordering (e.g. Yahoo, Hotmail, AOL)

7 Page 2 of 2 Payment Information Please indicate the payment method you would like to use by selecting the appropriate box. Pay by credit card: You will receive an with a link to a secure webpage to enter your credit card details. Pay by check: Please post the check, accompanied by this form, to: Research and Markets, Guinness Center, Taylors Lane, Dublin 8, Ireland. Pay by wire transfer: Please transfer funds to: Account number Sort code Swift code IBAN number Bank Address ULSBIE2D IE78ULSB Ulster Bank, Main Street, Blackrock, Co. Dublin, Ireland. If you have a Marketing Code please enter it below: Marketing Code: Please note that by ordering from Research and Markets you are agreeing to our Terms and Conditions at Please fax this form to: (646) or (646) From USA or From Rest of World