phishing emails and other malware or alerting them to the risks Define and implement a process on providing and maintaining involved in posting information relating to your business activities security awareness on social networks. Ensure all users are aware of their information security Encourage general security awareness within the organisation. A responsibilities security aware culture is likely to identify security risks. Define and implement a staff induction processes Keep your knowledge of threats up-to-date by reading security Provide staff training on Information Security and the responsibilities bulletins or newsletters from organisations relevant to your (including refresher training) business. Monitor the effectiveness of security training Provide training to staff so they recognise threats such as phishing Define and implement a process that covers communicating new emails and other malware, and risks involved in posting information Cyber threats to the staff relating to business activities on social networks, and if so, how Encourage to formally assess and validate their Information Based on: and IT Security guides for Small business, plus best Assurance skills. Promote an incident reporting culture practice Source (HM Government) – Requirement 9 Information Security Incident Response and Recovery – Small Business Category Corporate IT Category You should consider what actions you should put into should you This requirement requires appropriate information security incident suffer a data breach. Good incident management can reduce the management controls to have been implemented and maintained on an damage and distress caused to individuals. Please read key point 3 on-going basis. Please read key point 3 on page 1 before considering on page 1 before considering the following: the following: Examples Examples: Create an incident management plan, stating the actions to be Establish an incident management capability that can address the taken in the event of an information security incident full range of incidents that may occur, and includes senior management backing
phishing emails and other malware or alerting them to the risks involved in posting information relating to your business activities on social networks. Encourage general security awareness within the organisation. A security aware culture is likely to identify security risks. Keep your knowledge of threats up-to-date by reading security bulletins or newsletters from organisations relevant to your business. Provide training to staff so they recognise threats such as phishing emails and other malware, and risks involved in posting information relating to business activities on social networks, and if so, how Based on: and IT Security guides for Small business, plus best practice Define and implement a process on providing and maintaining security awareness Ensure all users are aware of their information security responsibilities Define and implement a staff induction processes Provide staff training on Information Security and the responsibilities (including refresher training) Monitor the effectiveness of security training Define and implement a process that covers communicating new Cyber threats to the staff Encourage to formally assess and validate their Information Assurance skills. Promote an incident reporting culture Source – (HM Government) Requirement 9 – Information Security Incident Response and Recovery Small Business Category Corporate IT Category You should consider what actions you should put into should you suffer a data breach. Good incident management can reduce the damage and distress caused to individuals. Please read key point 3 on page 1 before considering the following: Examples Create an incident management plan, stating the actions to be taken in the event of an information security incident This requirement requires appropriate information security incident management controls to have been implemented and maintained on an on-going basis. Please read key point 3 on page 1 before considering the following: Examples: Establish an incident management capability that can address the full range of incidents that may occur, and includes senior management backing
information-risk-questionnaire-self-assessment.docx