The policy shall be reviewed regularly to ensure it remains appropriate. Organizational Security Objective To manage information security within the organization Code of practice A management framework needs to be established to initiate, implement and control information security within the organization. This needs proper procedures for approval of the information security policy, assigning of the security roles and coordination of security across the organization. Specification (i.e. Detailed controls and objectives) The detailed controls and objectives are as follows: Information System Infrastructure should be in place to manage information security within the organization Third party access needs to be secure to maintain the security of organisational information processing facilities and information assets accessed by third parties Controls over Outsourcing need to be in place to maintain the security of information when the responsibility for information processing has been outsourced to another organisation Asset Classification and Control Objective To maintain appropriate protection of information assets. Code of practice One of the most laborious but essential task is to manage inventory of all the IT assets, which could be information assets, software assets, physical assets or other similar services. These information assets need to be classified to indicate the degree of protection. An Information Asset Register (IAR) should be created, detailing every information asset within the organisation. For example Databases, Personnel records, Scale models, Prototypes, Test samples, Contracts, Software licenses and Publicity material The Information Asset Register (IAR) should also describe who is responsible for each information asset and whether there is any special requirement for confidentiality, integrity or availability. Specification (i.e. Detailed controls and objectives) Accountability for assets to be established to maintain appropriate protection of organizational assets Information Classification to be done to ensure that information assets receive an appropriate level of protection Personnel Security Objective To reduce the risk of human error, theft, fraud or misuse of facilities Code of practice
The policy shall be reviewed regularly to ensure it remains appropriate. Organizational Security Objective To manage information security within the organization Code of practice A management framework needs to be established to initiate, implement and control information security within the organization. This needs proper procedures for approval of the information security policy, assigning of the security roles and coordination of security across the organization. Specification (i.e. Detailed controls and objectives) The detailed controls and objectives are as follows: Information System Infrastructure should be in place to manage information security within the organization Third party access needs to be secure to maintain the security of organisational information processing facilities and information assets accessed by third parties Controls over Outsourcing need to be in place to maintain the security of information when the responsibility for information processing has been outsourced to another organisation Asset Classification and Control Objective To maintain appropriate protection of information assets. Code of practice One of the most laborious but essential task is to manage inventory of all the IT assets, which could be information assets, software assets, physical assets or other similar services. These information assets need to be classified to indicate the degree of protection. An Information Asset Register (IAR) should be created, detailing every information asset within the organisation. For example Databases, Personnel records, Scale models, Prototypes, Test samples, Contracts, Software licenses and Publicity material The Information Asset Register (IAR) should also describe who is responsible for each information asset and whether there is any special requirement for confidentiality, integrity or availability. Specification (i.e. Detailed controls and objectives) Accountability for assets to be established to maintain appropriate protection of organizational assets Information Classification to be done to ensure that information assets receive an appropriate level of protection Personnel Security Objective To reduce the risk of human error, theft, fraud or misuse of facilities Code of practice
1311494623ISCA%20Notes.docx