Information Security Considerations
{"Image DocumentName": "Considerations for Security Managers", "Image ImageDescription": "Are information and information security critical to the entity? If so, does the board understand the criticality of information security? Considerations for Security Managers. Business objectives and demands drive the requirements for information and the attendant needs for information security. For many organizations, adequately secured information is crucial to key business processes, business initiatives and programs, and long-term plans and activities. The information security program needs to be aligned with essential business processes and activities. Unless board members understand the criticality of information security, there may be insufficient support for security programs intended to mitigate or manage the related risks. Information Sources. Evaluation and Performance Criteria. Information security policies and mission statements can be easily and explicitly linked to business objectives and demands. Critical business initiatives and activities are identified, and requirements for the integrity and availability of processes, information and information resources in support of these initiatives and activities are defined. Sensitive and private information is identified and security program requirements for its protection are defined. Legal, regulatory and contractual requirements related to process integrity, information confidentiality and business process continuance are identified and security program requirements defined. Security performance requirements are defined, and compliance is measured and reported to executive management. Security activities and effectiveness are tied to business objectives and demands. Board members receive a minimum of one annual report on the status of security for discussion and endorsement at a board meeting. Board-level sponsorship for security exists. The sponsorship promotes security and aids understanding of. other members of the board. Annual reports. Board and board committee reports. Business strategy documents. Industry analyst reports. Business impact assessment. Business risk analysis. Audit reports. Security incidents summaries. Security strategy documentation. Security architecture summary. Discussions with business process. owners. Security Program Initiatives. \u2022 At a high level, define the security program in terms of business initiatives, priorities and strategic goals. Integrate security planning into business planning activities. \u2022 Regularly report to senior management and to the board of directors identifying areas of business risk and the status of security programs related to this risk.", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}