IT Security Policy Framework

Establishing an effective Information Technology Security Policy Framework is critical in the development of a comprehensive security program. The purpose of the Information Security Policy Framework is to insure your organization will be able to provide the minimum security level necessary to maintain confidentiality, integrity, and availability of the information it collects and uses.

The ISO/IEC 27000-series consist of information security standards published jointly by the International Organization for Standardization (ISO) and the International Electro technical Commission (IEC). In accordance with ISO/IEC 2700, we begin to define the guidelines to support the interpretation and implementation of information protection (Johnson,2011). Organizations that claim to have adopted ISO/IEC 27000 can be audited and certified compliant with the standard.

NIST SP 800-53 is published by the National Institute of Standards and Technology (NIST), which is a non-regulatory agency of the United States Department of Commerce. NIST develops and issues standards, and guidelines, which assist federal agencies in implementing the Federal Information Security Management Act of 2002 (FISMA). FISMA is designed to help the agencies protect their information and information systems (Johnson,2011).

There are many different types of organizations and each different type of organization is required to be compliant with different applicable local laws and federal regulations. The healthcare industry is required to comply with requirements of HIPPA and the financial industry is responsible for FISMA and Sarbanes-Oxley Act. The best way to show we are in compliance is to make sure our policy and procedures are following al...

... middle of paper ...

...op the policies, and lack of accountability of management toward enforcement of the policies. We can overcome the challenges of implementations and following are the recommendations: Hiring the right leadership, creating the policy, assembling a team, performing a needs assessment, and developing a plan.

References

Johnson, R. (2011). Security Policies and Implementation Issues. Burlington: Jones and Bartlett

Learning.

Todd Fitzgerald,(2010),“Leveraging IT Control Frameworks for Compliance”, Retrieved:http://www.infosectoday.com/Articles/Control_Frameworks_for_Compliance.htm.

Y.P. Kosta (2010).Security Comparison of Wired and Wireless Network with Firewall and

Virtual Private Network. Retrieved from

http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=5460559&url=http%3A%2F%2Fieeexplore.ieee.org%2Fxpls%2Fabs_all.jsp%3Farnumber%3D5460559