Enterprise information security policy (eisp), Computer Network Security

Enterprise Information Security Policy (EISP)

EISP also known as security policy directly supports the mission of the organization and sets the strategic direction, scope, and tone for security efforts within the organization. It is an executive level document, drafted by or with CIO of the organization.

The EISP characteristically addresses compliance in two areas:

1.General compliance to ensure meeting requirements to establish program and responsibilities assigned therein to several organizational components.

2.Use of specific penalties and disciplinary action.

Information security policy has the concepts which are stated below.

1.Each agency operates in a manner consistent with maintenance of a shared, trusted environment within the state government for the protection of individual privacy and them assurance of data and business transactions. Each agency shall not jeopardize confidentiality, integrity/availability of the state enterprise; or the information stored, processed and transmitted by state information systems.

2.Evert agency follows established enterprise security policies, standards, processes and procedures, except where agency policy offers a higher level of security.

3.Each agency is responsible for developing policies, standards, processes and procedures to meet this policy. If it can be determined that more stringent measures are required, the agency is responsible for policies, standards processes and procedures development to meet the higher level of security.

4.Each agency will implement, develop, and exercise an agency business continuity plan. The plan will be based on advantage criticality and be consistent with the enterprise business continuity plan.

5.Each agency will implement a security alertness, training and education program for all staff including technical and non-technical staff both. The term program is used here intentionally. Each agency is expected to provide an ongoing, systematic training program by using a system wide approach. Every new employee will be given basic information technology security training within the 3 months of employment. All employees, that include interns, contractors, temporary and part time employees, should agree in writing to follow state and agency security policies before being authorized to access state computer resources.

6.Each agency is subject to annual security audit to assure compliance with this and other enterprise policies, standards, processes and procedures. An audit or review performed under another authority, like the Internal Revenue Service, can be substituted if similar in scope and approved by Chief Information Security Officer.

7.Every agency will have a vulnerability assessment which is performed on its information systems at least annually to gauge the effectiveness of security measures. Assessment results can be used to identify, prioritize, plan for and implement additional security measures and to update agency risk assessment.

8.Each agency will posses an information systems risk assessment performed at least every 2 years. This assessment will be used to identify, prioritize, plan for and implement additional security measures. The assessment methodology will be obtained by the Information Security Office and made available to the enterprise.

9.Security requirements will be defined and addressed throughout the life cycle of all information technology projects, including business requirements definition, design, development, testing, implementation and operation.

10. Each agency Chief Information Officer will assure his or her best ability that information systems  under their control meet enterprise and agency security policies, processes, standards, and procedures prior to being placed in production or after significant changes to the system. The Information Security Office will assess randomly the self certification process and individual systems to ensure adherence to policy.

11.All agencies will comply with suitable federal information security requirements.However, if federal or other requirements are inconsistent with the established state policy or standard, in whole/in part, then the Chief Information Security Officer can grant a waiver from the inconsistent portions of state policy or standard. Requests for a waiver should be submitted in writing and demonstrate that granting the waiver will not result in undue risk for enterprise or agency.

12. Individual privacy will be protected at all the times according to established laws, policies and rules.

13. Monitoring of the information system usage for malicious activity and misuse of government resources will be conducted by agencies as per their established policies, or by Department of Administrative Services, Iowa Communications Network or other party at request of the agency.

14. Each agency will report network changes which affects enterprise network security to the Information Security Office.

15. Agencies will report information security incidents which impact or could impact shared resources to the Information Security Office, following a common response plan which is developed, implemented and exercised jointly by Information Security Office and all agencies.


16. Computer resources and physical information, including but not limited to servers, desktops, network equipment, laptops, firewalls, hardcopies and tapes, have appropriate physical protections in place. Where possible, these resources should also be protected from structural and environmental threats.

17. Agencies will provide information to the Information Security Office describing all connections from their agency networks to outside resources including the Department of Administrative Services shared campus network, the Iowa Communications Network, private service providers, federal, local and municipal governments and other state agencies. Updates will be provided as changes occur.

18. Agencies will develop methods for implementing system patches, and other measures which are required to protect systems from known as vulnerabilities. The procedures will provide adequate testing prior to implementation to decrease the risk of a negative impact, but also assure the updates are applied quickly to assure protection.

19. Requests for exemption from any requirements of this policy will be submitted in writing by the agency director to Chief Information Security Officer prior to implementation

Posted Date: 10/9/2012 3:02:51 AM | Location : United States







Related Discussions:- Enterprise information security policy (eisp), Assignment Help, Ask Question on Enterprise information security policy (eisp), Get Answer, Expert's Help, Enterprise information security policy (eisp) Discussions

Write discussion on Enterprise information security policy (eisp)
Your posts are moderated
Related Questions
Evaluations, Assessment, and Maintenance of Risk Controls When the control strategy has been implemented, it should be monitored and measured on an ongoing basis to determine ef

Problem 1: Show what are the benefits of project quality management? • Customer satisfaction • Reduced cost • Increased competitiveness • Fulfilment of social and economic r

The following message was enciphered with a Vigenère cipher. aikiaawgfspxeppvjabjnivulfznzvkrlidamsmyamlvskniyffdpbwtnxsvvbtnamvltsefoeycztkomylmerkwrs deusjgecmzkwvnreeyp

QUESTION (a) A convex flow problem is a non linear network flow problem. Explain how a convex flow problem could be transformed into a Minimum Cost Flow problem. (b) Exp

Problem 1: What does the SNMP access policy show? SNMP community diagram SNMP access policy Problem 2: Does there exist any formal functional specificat

(a) Using the extended Euclidean algorithm, find the multiplicative inverse of 504 mod 67. (b) Decrypt the following ciphertext, which has been encrypted using Caesar cipher:

RING TOPOLOGY In this topology of network the devices are connected to each other in packed loop. In this network first computer passes data packet to the second and then seco

Question (a) Inspect the following ifconfig output of an IPv6 interface: i. What is the hidden Hardware Address of the interface on Line #1? ii. What is the hidden subn

Repeater known as regenerator ; it is an electronic machine that performs only at physical layer. It gets the signal in the network before it becomes loss or weak, recreates the

Question: (a) What is the minimum length of a password that could be considered to be "strong" in the context of today's computing power? (b) The security of a PIN system,