Information Systems Risk Management Program

• Purpose
• Policy Statement
• Responsibilities
• Information Security Risk Management Program
• Risk Assessment Process
• Description of Preventative Measures
• Description of Detection Measures
• Incident Response Plan
  • Recovery Procedures
  • Logging and Reporting
• Assessment of Risks, Controls, and Response Priorities
  • Incident Response Team plan (Included)

Information Security Program

• Introduction
• Policy Statement
• Information Security Risk Management Program
• Types of Controls
• Information Security Officer
• Security Administrators
• Logical Access Restrictions – User ID’s and Passwords
  • Minimum Password Requirements
  • Passwords are Authority to Act
  • Confidentiality of Passwords
  • Reporting Compromises of Passwords
  • Requests for System Access
  • Employee Terminations
  • Quarterly Review of Security Access Levels
• Description of Network and System Security
  • Core Processor
  • Open Systems and Microsoft Windows Server
  • Remote Access and Firewalls
• Security Monitoring Responsibilities
  • Core System Reports
  • Open Systems and Microsoft Windows Server
  • Remote Access and Firewall
• Security Parameter Settings
• Security Program Bulletins, Patches and Upgrades
• Other Preventative Measures and Controls
  • Data Entry Controls
  • Data Integrity
• Input and Output Controls
• Telecommunications Access Controls
• Transmission Controls

System and Documentation Backups

• Core System
• Critical Servers

Physical Security

• Servers
• Computer Hardware
• Computer Software

End-User Computing

• Terminal and Workstation Controls
• Internet Access and Email Policy
• Policy Statement Regarding Computer Software
• Software License Agreements and Copyrights

Software Documentation

Viruses

• Internet Viruses

PC Policy

• PC Inventory
• Environmental Control – PC’s and Workstations
• Protection of Media

Disposal of Obsolete Equipment

• Disaster Recovery Contingency Plans (High level description only)
• Information Security Insurance Policy
• Information Security Audits
• User Groups
• Vendor Selection Process
• Vendor Contracts
• Vendor Oversight

Authorized Security Administrators (Included)

• Security Access Request (Included)
• Internet and Email Policy (Included)