RSS News Feed Feed Description

 

 

Security Manual TemplateSecurity Manual Template
ISO 27000 (27001 & 27002) - Sarbanes-Oxley -
PCI - Patriot Act - HIPAA
Compliant

This Security Manual for the Internet and Information Technology is over 200 pages in length.  The template is compliant with ISO 27000 (formerly ISO 17799), Sarbanes-Oxley, Patriot Act and HIPAA and includes a PCI DSS Audit program. All versions of the Security Manual template include both the Business & IT Impact Questionnaire and the Threat & Vulnerability Assessment Tool (both were redesigned to address Sarbanes Oxley compliance).   In addition, the Security Manual Template PREMIUM Edition  contains 16 detail job descriptions that apply specifically to security and Sarbanes Oxley.

Clients can also subscribe to Janco's Security Manual update service and receive all updates to the Security Manual Template. 

The template includes everything needed to customize the Internet and Information Technology Security Manual to fit your specific requirement.  The electronic document includes proven written text and examples for the following major topics / sections for your security plan:
 

  • ISO 27000, Sarbanes-Oxley, Patriot Act, and HIPAA compliant

  • Security Manual Introduction - scope, objectives, general policy, and responsibilities

  • Risk Analysis - objectives, roles, responsibilities, program requirements, and practices program elements

  • Staff Member Roles - policies, responsibilities and practices

  • Physical Security  - area classifications, access controls, and access authority

  • Facility Design, Construction and Operational Considerations - requirements for both central and remote access points

  • Media and Documentation - requirements and responsibilities

  • Data and Software Security - definitions, classification, rights, access control, INTERNET, INTRANET, logging, audit trails, compliance, and violation reporting and follow-up

  • Sensitive Information Policy

  • Network Security - vulnerabilities, exploitation techniques, resource protection, responsibilities, encryption, and contingency planning

  • Internet and Information Technology contingency Planning - responsibilities and documentation requirements

  • Travel and Off-Site Meetings - specifics of what to do and not do to maximize security

  • Insurance - objectives, responsibilities and requirements

  • Outsourced Services - responsibilities for both the enterprise and the service providers

  • Waiver Procedures - process to waive security guidelines and policies,

  • Incident Reporting Procedures - process to follow when security violations occur

  • Access Control Guidelines - responsibilities and how to issue and manage badges / passwords

  • Sample Forms

    • Business and IT Impact Questionnaire

    • Threat & Vulnerability Assessment Tool

    • Security Violation Reporting form

    • Security Audit form

    • Inspection Check List

    • New Employee Security form

    • Security Access Application form

    • Employee Termination Checklist

    • Supervisor's Employee Termination Checklist

    • Sensitive Information Policy Compliance Agreement

    • HIPAA Audit Program Guide

    • ISO 27000 (27001 & 27002) Security Checklist

    • PCI DSS Audit Program

     


View The Table of Contents And A Few Pages


 

 
 
 
 
 
 

Latest News

Access 2007 All-in-One Desk Reference For Dummies - Shows how to accomplish specific tasks such as database housekeeping, security data, and using Access with the Web * Access is the world's leading desktop database solution and is used by millions of people to store, organize, view, ... -  more info

Hacking Online Banking and Credit Card Transactions – And How to ... - ... allows a hacker to connect to that home network (See Essential Wireless Hacking Tools for more info on securing your home network). An educated end-user and sound security practices by corporations can protect your valuable data. ... -  more info

A step-by-step guide to building a new SELinux policy module - If the file/directory is only read by the application, you are better off leaving it as the default file context. So conf files in /etc/ should usually be left as etc_t. Files with sensitive security data are the exception. ... -  more info

Great minds think alike? - Amazing... so since I've picked up Russ McRee on my crusade against stupidity (a la "Hacker Safe" and "Hacker Proof" seals) now we have another, slightly more prominent crusader. Nate McFeters over at ZDNet has written an article on ... -  more info

Security needs in embedded systems, by Anoop MS - The paper discusses the hardware and software security requirements in an embedded device that are involved in the transfer of secure digital data. The paper gives an overview on the security processes like encryption/decryption, ... -  more info

ZoneAlarm ForceField - Virtualized Browser Security - So your passwords, your confidential information, and your financial data remain protected. While traditional security, such as firewalls, antivirus, and security suites, protects your PC, ZoneAlarm ForceField protects your browser and ... -  more info

Chilean hacker 'exposes' poor data security - 12/05/2008. -  more info

Companies urged to boost data security - Viruses and worms have been blamed for over $12 million of lost revenue according to the FBI's Computer Crime Survey, according to reports. -  more info

Enjoy Ultimate Safety and Data Security with ASUS Motherboards - http://www.bit-tech.net/news/2008/05...motherboards/1. -  more info

McAfee security for the web! - Apparently, McAfee is building upon the fine reputation they have as a security company and are announcing that they will be adding a feature to your search. Starting this summer, if you're using their toolbar (and who isn't. ... -  more info

Just Saving Your Data Storage Devices Isn’t A Totally Secure ... - While security and data protection are essential, it is also significant to be able to recover data that has been lost due to user errors, viruses, system failures and other environmental threats. All companies using information ... -  more info

Data Communications Security Engineer - [Integrity Consulting ... - Job Opportunity available in Myrtle Beach, SC as a Data Communications Security Manager. This person will research, test, evaulate and recommend data communication and LAN/WAN hardware and software. Monitor newtork to ensure network ... -  more info

Point Sec Data Security - I work in a corporate environment that requires a security package called Point Sec be installed for those of us who work remotely. The only thing I have on my laptop that other remote workers do not have is the Articulate Presenter ... -  more info

Security, Privacy, and Trust -- Mission Impossible? - security management. This was later adopted as ISO 17799 and has now been. renamed as two standards ISO 27001/2. Specific industry standards have also. emerged such as the Payment Card Industry Data Security Standard (PCI-DSS). ... -  more info

New Data Risk Assessment Service From Pentura - Along with that, IT departments will be given the ability to constantly monitor data access behaviours surrounding their key systems, to ensure security is tailored to the businesses needs. Businesses are coming to realise quickly the ... -  more info

DWP staff ignoring new data protection rules - Despite new instructions forbidding insecure data transmission, staff at the Department for Work and Pensions still appear to be sending passwords with encrypted data. -  more info

Gemalto and McAfee, Inc. introduce simple two-factor ... - NET devices, guarantees that sensitive data, whether in transition or within the company, is secure. The integrated solution protects organizations from data security access breaches that result in costly disclosure events, lost revenue ... -  more info

Has VASCO Data Security International Inc. (up 3.98 percent, VDSI ... - Up 3.98% today. The stock has recovered 18.4% from its recent low price of 9.49 which occurred on 25-Apr-2008. A close above 20-day moving average of 11.67 could mark low of 9.49 as a recent low. The closest support can be found at ... -  more info

CTC Episode 19 - 12 May 2008 - Data Security and Encryption - Not only does encrypting your entire harddrive give you ultimate security, but Steve Gibson of Gibson Research has shown it to actually speed up your system. Plus, you can still use the hibernate function, a feature most encryption ... -  more info

Measuring the Effectiveness of Bulk Data Collection - The bigger story is that only 3% of London's street robberies [are] being solved by security cameras. This is certainly concerning, but this is one slice of crime. How do these tools assist in other crimes? The information provided in ... -  more info

Hacker leaks 6 million Chileans personal data - A hacker who identified himself as "Anonymous Coward" stole personal data of 6 million Chileans — reportedly including a daughter of the president — and posted it briefly on the Internet, authorities said Sunday. -  more info

Outfits face fines for lax data security - Britain’s privacy watchdog is given sharper teeth. -  more info

Webroot launches $1 million security data centre - Security provider Webroot this week launched its first data centre in the southern hemisphere to support its expansion into the Asia Pacific market. -  more info

How To Do Data Recovery, Data Security, Data Backup The Right Way - The thought of losing data due to a crashed or failed hard drive or perhaps a breach of data security sends chills down the spine of every grown man and woman. Once you except that you did not back up your data you need begin the data ... -  more info

CRS — Data Mining and Homeland Security: An Overview - In the context of homeland security, data mining can be a potential means to identify terrorist activities, such as money transfers and communications, and to identify and track individual terrorists themselves, such as through travel ... -  more info

 

© 2008 Janco Associates, Inc. - ALL RIGHTS RESERVED --  Revised: 05/02/08.