Usec 2.2

Information Security Program

Begins with policies, standards, and practices, which are the foundation for information security architecture and blueprint.

Strategic Planning

Planning for the management of the allocation of resources.

Contingency Planning

Planning for the preparation of an uncertain business environment.

Governance

A set of responsibilities and practices exercised by the board and executive management.

Standards

More detailed statements of what must be done to comply with the policy.

Enterprise Information Security Policy (EISP)

Sets the strategic direction, scope, and tone for all security efforts within the organization.

Issue-Specific Security Policy (ISSP)

Addresses specific areas of technology and contains the organization's position on a specific issue.

Systems-Specific Policy (SysSP)

Often functions as standards or procedures used when configuring or maintaining systems.

Information Security Blueprint

The basis for the design, selection, and implementation of security policies, education and training programs, and technological controls.

ISO 27000 Series

One of the most widely referenced security models; provides a standard framework for information security and states that organizational security policy is needed to provide management support and direction.

NIST Security Models

Approaches described in documents available from the Computer Security Resource Center of NIST.

Framework Core (NIST Cybersecurity Framework)

Set of information security activities an organization is expected to perform and their desired results.

Framework Tiers (NIST Cybersecurity Framework)

Help relate the maturity of security programs and implement corresponding measures and functions.

Framework Profile (NIST Cybersecurity Framework)

Used to perform a gap analysis between the current and desired state of information security/risk management.

Spheres of Security

Foundation of the security framework.

Management Controls (Levels of Controls)

Set the direction and scope of security processes and provide detailed instructions for their conduct.

Operational Controls (Levels of Controls)

Address personnel and physical security, and the protection of production.

Technical Controls (Levels of Controls)

Tactical and technical implementation related to designing and integrating security in the organization.

Defense in Depth

Implementation of security in layers.

Security Perimeter

The border of security protecting internal systems from outside threats.

Security Education, Training, and Awareness (SETA)

A control measure designed to reduce accidental security breaches.

Security Education

Ensures everyone in an organization is trained and aware of information security.

Security Training

Provides members of the organization with detailed information and hands-on instruction to prepare them to perform their duties securely.

Security Awareness

Keeps information security at the forefront of users’ minds.

Incident Response Plan (IRP)

Focuses on the immediate response.

Disaster Recovery Plan (DRP)

Focuses on restoring systems after disasters occur.

Business Continuity Plan (BCP)

Occurs concurrently with DRP when damage is major or ongoing, requiring more than simple restoration.

Hot Site

A ready-to-use site for quickly continuing operations.

Warm Site

A partially equipped site that requires some preparation before operations can resume.

Cold Site

A basic site requiring more preparation and equipment before operations can resume.

Business Impact Analysis (BIA)

Investigation and assessment of various adverse events that can affect an organization.

Off-Site Disaster Data Storage

The ability to move data into new site systems to get operations running quickly.

Crisis Management

Actions taken in response to an emergency.

Consolidated Contingency Plan

A single document set approach that combines all aspects of contingency policy and plan.