Enterprise information security policy (eisp), Computer Network Security

Enterprise Information Security Policy (EISP)

EISP also known as security policy directly supports the mission of the organization and sets the strategic direction, scope, and tone for security efforts within the organization. It is an executive level document, drafted by or with CIO of the organization.

The EISP characteristically addresses compliance in two areas:

1.General compliance to ensure meeting requirements to establish program and responsibilities assigned therein to several organizational components.

2.Use of specific penalties and disciplinary action.

Information security policy has the concepts which are stated below.

1.Each agency operates in a manner consistent with maintenance of a shared, trusted environment within the state government for the protection of individual privacy and them assurance of data and business transactions. Each agency shall not jeopardize confidentiality, integrity/availability of the state enterprise; or the information stored, processed and transmitted by state information systems.

2.Evert agency follows established enterprise security policies, standards, processes and procedures, except where agency policy offers a higher level of security.

3.Each agency is responsible for developing policies, standards, processes and procedures to meet this policy. If it can be determined that more stringent measures are required, the agency is responsible for policies, standards processes and procedures development to meet the higher level of security.

4.Each agency will implement, develop, and exercise an agency business continuity plan. The plan will be based on advantage criticality and be consistent with the enterprise business continuity plan.

5.Each agency will implement a security alertness, training and education program for all staff including technical and non-technical staff both. The term program is used here intentionally. Each agency is expected to provide an ongoing, systematic training program by using a system wide approach. Every new employee will be given basic information technology security training within the 3 months of employment. All employees, that include interns, contractors, temporary and part time employees, should agree in writing to follow state and agency security policies before being authorized to access state computer resources.

6.Each agency is subject to annual security audit to assure compliance with this and other enterprise policies, standards, processes and procedures. An audit or review performed under another authority, like the Internal Revenue Service, can be substituted if similar in scope and approved by Chief Information Security Officer.

7.Every agency will have a vulnerability assessment which is performed on its information systems at least annually to gauge the effectiveness of security measures. Assessment results can be used to identify, prioritize, plan for and implement additional security measures and to update agency risk assessment.

8.Each agency will posses an information systems risk assessment performed at least every 2 years. This assessment will be used to identify, prioritize, plan for and implement additional security measures. The assessment methodology will be obtained by the Information Security Office and made available to the enterprise.

9.Security requirements will be defined and addressed throughout the life cycle of all information technology projects, including business requirements definition, design, development, testing, implementation and operation.

10. Each agency Chief Information Officer will assure his or her best ability that information systems  under their control meet enterprise and agency security policies, processes, standards, and procedures prior to being placed in production or after significant changes to the system. The Information Security Office will assess randomly the self certification process and individual systems to ensure adherence to policy.

11.All agencies will comply with suitable federal information security requirements.However, if federal or other requirements are inconsistent with the established state policy or standard, in whole/in part, then the Chief Information Security Officer can grant a waiver from the inconsistent portions of state policy or standard. Requests for a waiver should be submitted in writing and demonstrate that granting the waiver will not result in undue risk for enterprise or agency.

12. Individual privacy will be protected at all the times according to established laws, policies and rules.

13. Monitoring of the information system usage for malicious activity and misuse of government resources will be conducted by agencies as per their established policies, or by Department of Administrative Services, Iowa Communications Network or other party at request of the agency.

14. Each agency will report network changes which affects enterprise network security to the Information Security Office.

15. Agencies will report information security incidents which impact or could impact shared resources to the Information Security Office, following a common response plan which is developed, implemented and exercised jointly by Information Security Office and all agencies.


16. Computer resources and physical information, including but not limited to servers, desktops, network equipment, laptops, firewalls, hardcopies and tapes, have appropriate physical protections in place. Where possible, these resources should also be protected from structural and environmental threats.

17. Agencies will provide information to the Information Security Office describing all connections from their agency networks to outside resources including the Department of Administrative Services shared campus network, the Iowa Communications Network, private service providers, federal, local and municipal governments and other state agencies. Updates will be provided as changes occur.

18. Agencies will develop methods for implementing system patches, and other measures which are required to protect systems from known as vulnerabilities. The procedures will provide adequate testing prior to implementation to decrease the risk of a negative impact, but also assure the updates are applied quickly to assure protection.

19. Requests for exemption from any requirements of this policy will be submitted in writing by the agency director to Chief Information Security Officer prior to implementation

Posted Date: 10/9/2012 3:02:51 AM | Location : United States







Related Discussions:- Enterprise information security policy (eisp), Assignment Help, Ask Question on Enterprise information security policy (eisp), Get Answer, Expert's Help, Enterprise information security policy (eisp) Discussions

Write discussion on Enterprise information security policy (eisp)
Your posts are moderated
Related Questions
CarALouer provides rental of cars to its customer on a regional basis i.e. a car is attached to a regional home-base which also houses a regional office of the company. Each regi

In 10 or more pages, address the following topics (be sure to use diagrams as well as references). 1) Define broadband and baseband transmission technology. 2) Describe broadban

Bridges perform both in the data link layers and physical of LANs of same kind. They split a bigger network in to smaller segments. They have logic that accept them to store the

Question: (a) What do you understand by the term "integrity"? (b) Which type of attack denies authorized users access to network resources? (c) You have discovered tha

Q. Explain about Security aware protocols? The security-Aware ad hoc Routing (SAR) protocol based on the security attributes integrated into the ad hoc route discovery provides

Question: (a) What are the various options to mitigate risks in an Information Security Management System (ISMS)? For each option specify an instance where it can be used.

Explain in DES Data Encryption Standard : DES stands for Data Encryption Standard and is explained as follows: DES is at present the most widely used key cryptographic systems

Problem a) Give the destination IP address, upper layer protocol, TTL in decimal and header checksum in hexadecimal; the source port number and the destination port number in deci

- Alice, Bob and Charlie have a secret key a=3, b=4, c=5, in that order. - They would like to find a common secret key using Diffie-Hellan key exchange protocol (with g=2, p=5).

MAC Address The address for a machine as it is identified at the Media Access Control (MAC) layer in the network structure. MAC address is generally stored in ROM on the n