|
5. Security Policy Management
Objectives |
|
5.1 Establish a
comprehensive information security policy.
-
Establish a
comprehensive information security policy.
-
Make sure that your
information security policy provides
clear direction for your information security program.
-
Make sure that your
information security policy shows that
your management is committed to information security.
-
Make sure that your
management supports
your organization’s information security policy.
-
Make sure that your
information security policy
shows that your management is prepared to support
an ongoing commitment to information security.
-
Make sure that your
information security policy
is consistent with your business objectives.
-
Make sure that your
information security policy
meets your organization’s business requirements.
-
Make sure that your
information security policy
complies with all relevant laws and regulations.
|
|
6. Corporate Security
Management Objectives |
|
6.1 Establish an
internal security organization.
-
Establish a management
framework to control how
your organization implements information security.
-
Make sure that your
management approves
your organization’s information security policy.
-
Make sure that
management assigns security roles.
-
Make sure that your
management coordinates the
implementation of security across your organization.
-
Make sure that your
management reviews the
implementation of security across your organization.
-
Make sure that you have
access to information security
experts and advisors within your own organization.
-
Make sure that your
internal experts are able to
provide specialized information security advice.
-
Make sure that you have
access to external
security experts, advisors, and authorities.
-
Use your external
advisors to help you
monitor changes in security standards.
-
Use your external
advisors to help you monitor
changes in security assessment methods.
-
Use your external
advisors to help you
keep up with industrial security trends.
-
Make sure that your
external information security experts
and advisors can help you to deal with security incidents.
-
Make sure that your
organization encourages the use
of a multi disciplinary approach to information security.
6.2
Control external party use of your information.
Maintain the
security of your organization’s information
whenever it is being
accessed by external parties.
Maintain the
security of your organization’s information
whenever it is being
processed by external parties.
Maintain the
security of your organization’s information
whenever it is being managed
by external parties.
Maintain the
security of your organization’s
information processing facilities whenever
they are being managed by external parties.
Maintain the
security of your organization’s
information processing facilities whenever
they are being accessed by external parties.
Maintain the
security of your organization’s
information processing facilities whenever
information is processed by external parties.
Maintain the
security of your information processing
facilities whenever external parties are allowed to
communicate with
these facilities.
Make sure that the
security of your organization’s
information processing facilities is not compromised
by the influence of external party products or services.
Make sure that the
security of your information is not
compromised by external party
products or services.
Control external
party access to your information.
Control external
party access to your
information processing facilities.
Control how external
parties process your information.
Control how external
parties use your organization’s
information for communication purposes.
Carry out a risk
assessment whenever there is
a business need to allow external parties to access
your organization’s information processing facilities.
Make sure that your
risk assessments examine security
implications whenever there is a need
to allow external
parties to access your information processing facilities.
Make sure that your
risk assessments identify your control
requirements whenever there is a
need to allow external
parties to access your information processing
facilities.
Establish agreements
that identify the controls that must
be applied whenever there is a need to allow external
parties to access your information processing facilities.
Carry out a risk
assessment whenever there is a business
need to allow external parties
to access your information.
Make sure that your
risk assessments examine security
implications whenever there is a need
to allow external
parties to access your information.
Make sure that your
risk assessments identify your control
requirements whenever there is a
need to allow external
parties to access your information.
Establish agreements
that identify the controls that must
be applied whenever there is a need to allow external
parties to access your information.
|
|
7. Organizational Asset
Management Objectives |
|
7.1 Establish
responsibility for your organization's assets.
-
Protect your
organization’s assets.
-
Use controls to protect
your assets.
-
Account for your
organization’s assets.
-
Nominate owners for all
organizational assets.
-
Make nominated owners
responsible for
protecting your organization’s assets.
-
Assign responsibility
for the maintenance of asset controls.
-
Make your asset owners
responsible for protecting your
organization’s assets even though owners
may have
delegated the responsibility for implementing controls.
7.2 Use an information classification system.
Provide an
appropriate level of protection
for your organization’s information. Establish an
information classification system. Use your
classification system to define security levels. Specify how much
protection is expected at each level. Assign a security
priority to each information security level. Use your
organization’s information classification system
to specify how
information should be protected at each level. Use your
organization’s information classification system
to specify how
information should be handled at each level.
|
|
8. Human Resource Security
Management Objectives |
|
8.1 Emphasize
security prior to employment.
-
Reduce the risk of
theft, fraud, or misuse of facilities by
making sure that all prospective employees understand
their responsibilities before you hire them.
-
Reduce the risk of
theft, fraud, or misuse of facilities by
making sure that all prospective contractors understand
their responsibilities before you hire them.
-
Reduce the risk of
theft, fraud, or misuse of facilities by
making sure that all third-party users understand their
responsibilities
before you allow them to use your facilities.
-
Reduce the risk of
theft, fraud, or misuse of facilities by
making sure that all prospective employees are suitable
given the roles that they will be asked to carry out.
-
Reduce the risk of
theft, fraud, or misuse of facilities by
making sure that all prospective contractors are suitable
given the tasks that they will be asked to carry out.
-
Reduce the risk of
theft, fraud, or misuse of facilities by
making sure that all third party users are suitable before
you allow them to use your facilities.
-
Use job descriptions to
specify the security responsibilities
that new personnel will be asked
to carry out.
-
Use employment terms and
conditions to specify the security
responsibilities that new personnel
will be asked to carry out.
-
Screen all employees
before you hire them, especially
when they will be asked to perform sensitive jobs.
-
Screen all contractors
before you hire them, especially
when they will be asked to provide sensitive services.
-
Screen all third-party
users, especially when they
will be allowed to access sensitive information.
-
Ask prospective
employees to sign agreements that
specify what their security roles and responsibilities are.
-
Ask prospective
contractors to sign agreements that
specify what their security roles and responsibilities are.
-
Ask prospective
third-party users to sign agreements that
specify what their security
roles and responsibilities are.
8.2
Emphasize security during employment.
Emphasize the need
to protect your information.
Emphasize the need
to reduce risk of human error.
Make employees aware
of information
security threats and concerns.
Make contractors
aware of information
security threats and concerns.
Make third party
users aware of information
security threats and concerns.
Make employees aware
of their
information security responsibilities.
Make contractors
aware of their
information security responsibilities.
Make third party
users aware of their
information security responsibilities.
Make employees aware
of their
information security liabilities.
Make contractors
aware of their
information security liabilities.
Make third party
users aware of
their information security liabilities.
Make sure that
employees know how to support and
apply your security policy during the course of their work.
Make sure that
contractors know how to support and
apply your security policy during the course of their work.
Make sure that third
party users know how to support and
apply your security policy during
the course of their work.
Make managers
responsible for ensuring that employees
carry out their security responsibilities throughout the
course of their employment with your organization.
Provide an adequate
level of security education
and training to your organization’s employees.
Provide an adequate
level of security education
and training to your organization’s contractors.
Provide an adequate
level of security education
and training to all third party users.
Minimize your
security risk by ensuring that employees
know how to use your organization’s security procedures.
Minimize your
security risk by ensuring that contractors
know how to use your organization’s security procedures.
Minimize your
security risk by ensuring that third party
users know how to use your security procedures.
Minimize your
security risk by ensuring that employees
know how to use your information processing facilities.
Minimize your
security risk by ensuring that contractors
know how to use your information processing facilities.
Minimize your
security risk by ensuring that third party users
know how to use your
information processing facilities.
Establish a formal
disciplinary process that
must be used to handle security breaches.
8.3 Emphasize security at termination of
employment.
-
Control how employees are
terminated.
-
Control how contractors
are terminated.
-
Control how third party
users are terminated.
-
Control how employees are
reassigned.
-
Control how contractors
are reassigned.
-
Control how third party
users are reassigned.
-
Make sure that employees,
contractors, and third party
users exit your organization in an orderly manner.
-
Make sure that employees,
contractors, and third party
users change their work assignments in an orderly manner.
-
Make managers responsible
for controlling how employees,
contractors, and third party users are terminated or reassigned.
-
Make sure that all
equipment is returned when
employees, contractors, or third party users
are terminated or reassigned.
-
Make sure that all access
rights and privileges
are removed when employees, contractors, or
third party users are terminated or reassigned.
|
|
9. Physical and Environmental
Security Management Objectives |
|
9.1 Use secure
areas to protect facilities.
-
Use physical methods to
prevent unauthorized access
to your organization’s information and premises.
-
Use physical methods to
prevent people from
damaging your information and premises.
-
Use physical methods to
prevent people from
interfering with your information and premises.
-
Keep your organization’s
critical or sensitive
information processing facilities in secure areas.
-
Use defined security
perimeters to protect your
critical or sensitive information processing facilities.
-
Use appropriate security
barriers to protect your
critical or sensitive information processing facilities.
-
Use entry controls to
protect your critical or
sensitive information processing facilities.
-
Make sure that your
physical protection methods
are commensurate with identified security risks.
9.2 Protect
your organization's equipment.
Prevent damage to
your organization’s equipment.
Prevent the loss of
your organization’s equipment.
Prevent the theft of
your organization’s equipment.
Protect your
equipment from physical threats.
Protect your
equipment from environmental threats.
Protect equipment in
order to avoid work interruptions.
Protect equipment in
order to avoid unauthorized
access to your organization’s information.
Protect your
equipment through proper disposal.
Use secure siting
strategies to protect your equipment.
Use special controls
to safeguard supporting facilities.
|
|
10. Communications and
Operations Management Objectives |
|
10.1 Establish
procedures and responsibilities.
-
Define responsibilities
that explain how information
processing facilities should be managed and
operated.
-
Assign responsibility
for the management and operation
of your organization’s information processing facilities.
-
Establish procedures to
operate and control your
organization’s information processing facilities.
-
Use procedures to ensure
that information processing
facilities are always secure and operated correctly.
-
Segregate information
processing duties in order to prevent
damage or misuse caused by
negligence or sabotage.
10.2
Control third party service delivery.
Control how third
parties deliver
services to your organization.
Make sure that third
parties comply with
your information security requirements.
Make sure that third
parties comply with
third party service delivery agreements.
Make sure that third
parties maintain an appropriate level
of information security for the duration of their contracts.
Monitor third
parties in order to ensure that service
delivery continues to comply with third party agreements.
Control changes to
third party service delivery agreements
in order to ensure that they comply with all requirements.
10.3 Carry out future system planning activities.
-
Avoid future system
failures by developing plans to
ensure that adequate information processing capacity
and resources will be available in the future.
-
Avoid future system
failures by projecting what your
system performance requirements will be in the future.
-
Avoid future system
overloads by projecting what
your information processing capacity and resource
requirements will be in
the future.
-
Establish the operational
requirements of new
systems prior to their acceptance and use.
-
Document the operational
requirements of new
systems prior to their acceptance and use.
-
Test the operational
requirements of new
systems prior to their acceptance and use.
10.4 Protect against malicious and mobile code.
-
Protect the integrity of
your software.
-
Protect the integrity of
your information.
-
Prevent the introduction
of malicious
code and unauthorized mobile code.
-
Detect the introduction of
malicious
code and unauthorized mobile code.
-
Protect your
organization's software and information
processing facilities against computer viruses.
-
Protect your software and
information
processing facilities against network worms.
-
Protect your software and
information
processing facilities against Trojan horses.
-
Protect your software and
information
processing facilities against logic bombs.
-
Make users aware of the
dangers and the
damage that malicious code can cause.
-
Make sure that your
managers have established
controls that staff can use to prevent malicious code.
-
Make sure that your
managers have established controls
that staff can use to detect the existence of malicious code.
-
Make sure that your
managers have established
controls that staff can use to remove malicious code.
-
Make sure that your
managers have
taken steps to control mobile code.
10.5 Establish backup procedures.
-
Maintain the availability
and integrity of your information and
information processing facilities by
backing up your data.
-
Develop procedures to
implement your
data backup policy and strategy.
-
Develop data restoration
procedures and make
sure that restoration activities are rehearsed.
10.6 Protect computer networks.
-
Protect the information on
your networks.
-
Protect the infrastructure
that supports your networks.
-
Protect networks that span
organizational boundaries.
-
Protect sensitive
information passing over public networks.
10.7 Control how media are handled.
-
Control your
organization’s media.
-
Protect your
organization’s media.
-
Prevent unauthorized
disclosure by protecting your media.
-
Prevent unauthorized
modifications by protecting your media.
-
Prevent the removal of
assets by protecting your media.
-
Prevent the destruction of
assets by protecting your media.
-
Prevent business
interruptions by protecting your media.
-
Establish operating
procedures to protect your documents.
-
Establish operating
procedures to protect computer media.
-
Establish operating
procedures to protect input/output data.
-
Establish procedures to
protect system documentation.
-
Make sure that your
operating procedures
prevent unauthorized disclosures.
-
Make sure that your
operating procedures prevent
the unauthorized modification of your media.
-
Make sure that your
operating procedures prevent
the unauthorized destruction of your media.
-
Make sure that your
operating procedures prevent
the unauthorized removal of your media.
10.8 Protect exchange of information.
Protect and control the exchange of
information within your own organization.
Protect and control the exchange of
software within your own organization.
Protect and control the exchange of information
between
your organization and other external organizations.
Protect and control the exchange of software between
your organization and other external organizations.
Establish a formal policy to control how information
and software is exchanged between organizations.
Use formal agreements to control how information
and software is exchanged between organizations.
Comply with all relevant legislation that governs
and
controls the exchange of information and software
between organizations (also see clause 15 below).
Establish procedures to protect information and
physical
media exchanged within or between organizations.
Establish standards to protect information and
physical
media exchanged within or between organizations.
10.9 Protect electronic commerce services.
Make sure that your organization’s electronic
commerce (ecommerce) services are secure.
Make sure that ecommerce service usage is secure.
Consider security if you use ecommerce services.
Consider security if you process online
transactions.
Protect the integrity of information that is
published using publicly accessible systems.
Protect the availability of information that is
published using publicly accessible systems.
Establish controls to protect ecommerce activities.
10.10 Monitor information processing facilities.
Monitor information processing systems
in order to detect unauthorized activities.
Record your information security events.
Use operator logs to detect information system
problems.
Use fault logging to detect information system
problems.
Make sure that your information monitoring and
logging
activities comply with all relevant legal requirements.
Use system monitoring to check how effective
controls are.
Use system monitoring to verify that information
processing
activities comply with your organization’s access policy.
|
|
11. Information Access Control
Management Objectives |
|
11.1 Control
access to information.
-
Control access to your
organization’s information.
-
Make sure that your
information access controls
meet your organization’s business requirements.
-
Make sure that your
information access controls
meet your organization’s security requirements.
-
Control access to
information processing facilities.
-
Make sure that your
facility access controls meet
your organization’s business requirements.
-
Make sure that your
facility access controls meet
your organization’s security requirements.
-
Control access to your
business processes.
-
Make sure that your
process access controls
meet your organization’s business requirements.
-
Make sure that your
process access controls
meet your organization’s security requirements.
-
Make sure that your
access control rules comply
with your information dissemination policies.
-
Make sure that your
access control rules comply
with your information authorization policies.
11.2 Manage user
access rights.
Control authorized
access to information systems.
Prevent unauthorized
access to information systems.
Establish formal
procedures to control how the right to
access information systems and services is allocated.
Ensure that your
access allocation procedure controls
all stages of the users’ access life cycle from initial user
registration to final de-registration.
Ensure that your
access allocation procedure pays special
attention to the allocation of
privileged access rights which
allow users to override normal system
controls.
11.3 Encourage good access practices.
-
Prevent unauthorized user
access to your
information and information processing facilities.
-
Prevent information and
information processing facilities
from being exposed to possible loss or damage.
-
Prevent the theft of
information and information facilities.
-
Ask authorized users to
help you control access to your
information systems and information
processing facilities.
-
Make authorized users
responsible for helping you to control
access to information and
information processing facilities.
-
Make users aware of what
they must do to control access.
-
Make users aware of what
they must do to protect passwords.
-
Make users aware of what
they must do to protect equipment.
-
Reduce the risk of
unauthorized access or damage to papers,
media, and facilities by
implementing a clear desk policy.
-
Reduce the risk of
unauthorized access or damage to papers,
media, and facilities by
implementing a clear screen policy.
11.4 Control access to network services.
-
Prevent unauthorized
access to internal networked services.
-
Prevent unauthorized
access to external networked services.
-
Control access to internal
networked services.
-
Control access to external
networked services.
-
Control access by using
the appropriate interfaces between
your network and networks owned by
other organizations.
-
Control access by using
the appropriate interfaces
between your network and public networks.
-
Control access to networks
by using the appropriate
authentication mechanisms for users and
equipment.
-
Control user access to
information services.
11.5 Control access to operating systems.
-
Prevent unauthorized
access to your operating systems.
-
Restrict operating system
access to authorized users.
-
Establish ways of
controlling access to operating systems.
-
Make sure that your
operating system access control
methods comply with your access control policy.
-
Make sure that your access
control methods
are capable of authenticating authorized users.
-
Make sure that your access
control methods are capable
of recording successful and failed authentication attempts.
-
Make sure that your access
control methods are capable
of recording the use and abuse of special system privileges.
-
Make sure that your access
control methods are capable
of issuing alarms when system security policies are violated.
-
Make sure that your access
control methods are capable
of restricting user connection time when appropriate.
11.6 Control access to applications and systems.
-
Prevent unauthorized
access to information
held in your organization’s application systems.
-
Use security facilities to
restrict logical access
to your organization’s application systems.
-
Use security facilities to
restrict logical access
within your organization’s application systems.
-
Make sure that access to
your application systems
and information is regulated by a formal business
access control policy.
-
Make sure that your
application systems control
user access to application system functions.
-
Make sure that your
application systems control user
access to information held within application systems.
-
Make sure that application
systems can prevent utilities,
that are capable of overriding or bypassing system or
application
controls, from having unauthorized access.
-
Make sure that your
application systems can prevent
operating system software, that is capable of overriding
or bypassing controls, from having unauthorized access.
-
Make sure that your
application systems can prevent malicious
software, that is capable of
overriding or bypassing controls,
from having unauthorized access.
-
Make sure that your
application systems do not compromise
the security of other interrelated
application systems.
11.7 Protect mobile and teleworking facilities.
-
Make sure that information
is protected when
mobile computing facilities are being used.
-
Make sure that your
security initiatives address the
risks that your mobile computing activities create.
-
Make sure that your mobile
security initiatives
address the risks associated with having to work
in an unprotected environment.
-
Make sure that information
is protected
when teleworking facilities are being used.
-
Make sure that your
security initiatives address
the risks that your teleworking activities create.
-
Take steps to protect your
teleworking sites.
-
Establish arrangements
that support and protect
your organization’s teleworking activities.
|
|
12. Systems Development and
Maintenance Objectives |
|
12.1 Identify
information system security requirements.
-
Make sure that security
is part of your information systems.
-
Identify the security
requirements that your organization’s
information systems must meet
before you start the system
development process.
-
Identify the security
requirements that your information
systems must meet before you
implement these systems.
-
Identify the security
requirements that operating systems
must meet before you develop or implement such systems.
-
Identify the security
requirements that business applications
must meet before you develop or
implement them.
-
Identify the security
requirements that user developed
applications must meet before you
implement them.
-
Identify the security
requirements that off-the-shelf
products must meet before you implement or install them.
-
Identify the security
requirements that infrastructure must
meet before you develop or implement your infrastructure.
-
Identify the security
requirements that services must
meet before you develop or implement these services.
-
Document the security
requirements that
your information systems must meet.
-
Make sure that your
documentation justifies and
explains why security requirements must be met.
-
Make sure that security
is part of the business justification
for developing or implementing your information systems.
12.2 Make sure applications process information
correctly.
Make sure that
applications process information correctly.
Prevent errors from
occurring in applications.
Prevent the loss of
information in applications.
Prevent the misuse
of information in applications.
Prevent the
unauthorized modification of information.
Make sure security
controls are designed into applications.
Design security
controls into user developed applications.
Use security
controls to validate your input data.
Use security
controls to validate internal processing.
Use security
controls to validate your output data.
Design additional
security controls into systems that
process valuable, sensitive, or critical information.
Design additional
security controls into systems that
have an impact on valuable, sensitive, or critical assets.
Use security risk
assessments to identify security
requirements and to select controls for
systems.
12.3 Use cryptographic controls to protect your
information.
-
Use cryptographic controls
to protect the confidentiality,
authenticity, and integrity of your
organization’s information.
-
Establish a policy on the
use of cryptographic controls.
12.4 Protect and control your organization's
system files.
-
Ensure the security of
your organization’s system files.
-
Control access to your
organization’s system files.
-
Control access to your
program source code.
-
Make sure that IT projects
and support activities do
not compromise the security of your system files.
-
Make sure that sensitive
or critical data
is not exposed in test environments.
12.5 Control development and support processes.
-
Control your
organization’s information system
development projects and support environments.
-
Maintain the security of
application system
software throughout the development process.
-
Maintain the security of
information
throughout the development process.
-
Make sure that application
system managers are
also responsible for the security of development
projects and support environments.
-
Make sure that application
system managers are
responsible for ensuring that all system changes
are checked in order to ensure that they do not
compromise the security of the system.
-
Make sure that application
system managers are
responsible for ensuring that all system changes
are checked to ensure that they do not compromise
the security of the operating environment.
|
|
13. Information Security Incident
Management Objectives |
|
13.1 Report
information security events and weaknesses.
-
Make sure that
information system
security incidents are promptly reported.
-
Make sure that
information system security events
and weaknesses are promptly communicated.
-
Make sure that
information security incident reports and
communications allow timely
corrective actions to be taken.
-
Establish formal
security event reporting procedures.
-
Establish formal
security escalation procedures.
-
Make sure that all
employees know how to report
information security events and weaknesses.
-
Make sure that all
contractors know how to report
information security events and weaknesses.
-
Make sure that all third
party users know how to
report information security events and weaknesses.
-
Make sure that employees
are officially required to
report information security events and weaknesses
to a designated point of contact.
-
Make sure that
contractors are officially required to
report information security events and weaknesses
to a designated point of contact.
-
Make sure that third
party users are officially required
to report information security events and weaknesses
to a designated point of contact.
13.2 Manage information security incidents and
improvements.
Make sure that your
organization's information security incident
management approach is both
effective and consistently applied. Make people
responsible for handling information security
events and weaknesses once
they have been reported. Establish procedures
for handling information security
events and weaknesses once they have been reported. Continually improve
how you manage your
organization’s information security incidents. Continually improve
how you respond to your
organization’s information security incidents. Continually improve
how you monitor your
organization’s information security incidents. Continually improve
how you evaluate your
organization’s information security incidents. Collect evidence
about information security incidents
whenever it is required in order to
support legal action.
|
|
14. Business Continuity
Management Objectives |
|
14.1 Use
continuity management to protect your information.
-
Establish a business
continuity management process.
-
Use your business
continuity management process
to counteract interruptions in your business activities.
-
Use your business
continuity management process
to protect your critical business processes during
major information system failures.
-
Use your business
continuity management process
to minimize the impact on your organization during
major information system failures.
-
Use your business
continuity management process
to ensure that essential operations are resumed
as quickly as possible.
-
Use your business
continuity management process
to ensure that lost information assets are recovered
as quickly as possible.
-
Use your business
continuity management process
to recover information assets that have been lost or
damaged by natural disasters.
-
Use your business
continuity management process
to recover information assets that have been lost or
damaged by equipment failures.
-
Use your business
continuity management process
to recover information assets that have been lost or
damaged by deliberate action.
-
Use your business
continuity management process
to recover information assets that have been lost or
damaged by accidents.
-
Use your business
continuity management process
to integrate the need to restore critical business
processes with the need to also restore information
assets after a business interruption.
-
Use your business
continuity management process
to integrate the need to restore critical operations
with the need to also restore information assets
after a business interruption.
-
Use your business
continuity management process
to integrate the need to restore critical facilities with
the need to also restore information assets after
a business interruption.
-
Use your business
continuity management process
to integrate the need to restore critical materials with
the need to also restore information assets after
a business interruption.
-
Use your business
continuity management process
to integrate the need to restore critical staffing levels
with the need to also restore information assets after
a business interruption.
-
Use your business
continuity management process
to integrate the need to restore critical transportation
systems with the need to also restore information
assets after a business interruption.
-
Carry out a business
impact analysis in order to identify
and evaluate the impact that major destructive events
could have on your critical business processes.
-
Analyze the impact that
disasters could
have on your critical business processes.
-
Analyze the impact that
security failures
could have on critical business processes.
-
Analyze the impact that
a loss of service
could have on critical business processes.
-
Analyze the impact that
unavailable services
could have on critical business processes.
-
Develop and implement
business continuity plans
in order to ensure that essential operations can be
restored within a reasonable period of time.
-
Make sure that
information security is integrated into
your organization’s overall business continuity process.
-
Make sure that
information security is integrated into
your organization’s many management processes.
-
Establish preventive
controls that you can use
to help prevent the loss of information assets.
-
Establish recovery
controls that you can use to help
restore information assets after a business interruption.
-
Establish controls that
can help you to identify risks.
-
Establish controls that
can help you to reduce risks.
-
Establish controls that
can help you to limit the
damage that serious incidents could cause.
-
Establish controls that
can help you to ensure that
business process information is readily available.
|
|
15. Compliance Management Objectives |
|
15.1 Comply with
legal requirements.
-
Make sure that your
information systems comply
with all relevant statutory security requirements.
-
Make sure that your
information systems comply
with all relevant regulatory security requirements.
-
Make sure that your
information systems comply
with all relevant contractual security requirements.
-
Design your information
systems in compliance
with all relevant statutory, regulatory, and
contractual security requirements.
-
Operate your information
systems in compliance
with all relevant statutory, regulatory, and
contractual security requirements.
-
Manage your information
systems in compliance
with all relevant statutory, regulatory, and
contractual security requirements.
-
Make sure that the users
of your information systems
comply with all relevant statutory, regulatory, and
contractual security requirements.
-
Consult with legal
experts in order to ensure that your
information systems comply with all
relevant national
and international legal security requirements.
15.2 Perform
security compliance reviews.
Make sure that your
systems comply
with your organization’s security policies.
Make sure that your
systems comply with
your organization’s security standards.
Review the security
of your information systems.
Make sure that your
information security
reviews are carried out on a regular basis.
Review the security
of your information systems by
examining how well they comply with security policies.
Audit your technical
platforms and information systems
by examining how well they comply with relevant security
implementation
standards.
Audit your technical
platforms and information systems
by examining how well they comply with documented
security control requirements.
15.3 Carry out controlled information system
audits.
-
Perform audits of your
information systems.
-
Establish controls to
safeguard operational systems
while information system audits are being performed.
-
Establish controls to
safeguard audit software and data
files while information system audits are being performed.
-
Establish controls to
safeguard the integrity of audit tools.
-
Establish controls to
prevent the misuse of audit tools.
|
|
|
