Individual Policies

All of the policies that are provided here are contained within one or more of the templates that are on this site. These policies have been added as individual documents in WORD format for those clients who just need this particular policy. All policies are Sarbanes-Oxley compliant.

Internet,
E Mail and
Electronic Communication
Policy

This policy is twenty-three (23) page in length, is compliant with all recent legislation (SOX, HIPAA, Patriot Act, and Sensitive information), and covers:

Appropriate use of equipment

Internet access

Electronic Mail

Retention of e-mail on personal systems

E-mail and business records retention

Copyrighted materials

Banned activities

Ownership of information

Security

Sarbanes-Oxley

Abuse

Included are ready to these ready to use forms:

Internet & Electronic Communication Employee Acknowledgement (short form)

E-Mail - Employee Acknowledgement (short form)

Internet Use Approval Form

Internet Access Request Form

Sensitive Information Policy

This policy covers the treatment of Credit Card, Social Security, Employee, and Customer Data. The policy is 15 pages in length. This policy complies with Sarbanes Oxley Section 404.

The policy applies to the entire enterprise, its vendors, its suppliers (including outsourcers) and co-location providers and facilities regardless of the methods used to store and retrieve sensitive information (e.g. online processing, outsourced to a third party, Internet, Intranet or swipe terminals). CLICK on image to get the full table of contents and a sample page

Travel and Off-Site Meeting Policy

Protection of data and software is often is complicated by the fact that it can be accessed from remote locations. As individuals travel and attend off-site meetings with other employees, contractors, suppliers and customers data and software can be compromised. This policy is four page in length and covers:

Outsourcing Policy

This policy is seven page in length and covers:

In Information Security, Intrusion Detection is the act of detecting actions that attempt to compromise the confidentiality, integrity or availability of a resource. Intrusion Detection does not, in general, include prevention of intrusions.

Intrusion Detection can be performed manually or automatically. Manual intrusion detection might take place by examining log files or other evidence for signs of intrusions, including network traffic. A system that performs automated intrusion detection is called an Intrusion Detection System (IDS). An IDS can be either host-based, if it monitors system calls or logs, or network-based if it monitors the flow of network packets. Modern IDSs are usually a combination of these two approaches. Another important distinction is between systems that identify patterns of traffic or application data presumed to be malicious (misuse detection systems), and systems that compare activities against a 'normal' baseline (anomaly detection systems).

When a probable intrusion is discovered by an IDS, typical actions to perform would be logging relevant information to a file or database, generating an email alert, or generating a message to a pager or mobile phone.

Determining what the probable intrusion actually is and taking some form of action to stop it or prevent it from happening again are usually outside the scope of Intrusion Detection. However, some forms of automatic reaction can be implemented through the interaction of Intrusion Detection Systems and access control systems such as firewalls.

Some authors classify the identification of attack attempts at the source system as Extrusion Detection (also known as Outbound Intrusion Detection) techniques.

Individual Policies

Internet,
E Mail and
Electronic Communication
Policy

This policy is twenty-three (23) page in length, is compliant with all recent legislation (SOX, HIPAA, Patriot Act, and Sensitive information), and covers:

Sensitive Information Policy

This policy covers the treatment of Credit Card, Social Security, Employee, and Customer Data. The policy is 15 pages in length. This policy complies with Sarbanes Oxley Section 404.

Travel and Off-Site Meeting Policy

Data and application security

Minimize attention

Shared public resources

Off-site meeting special considerations

Outsourcing Policy

This policy is seven page in length and covers:

Outsourcing Management Standard

Service Level Agreement

Responsibility

Outsourcing Policy

Policy Statement

Goal

Approval Standard

Base Case

Responsibilities

Latest News

Individual Policies

Internet, E Mail and Electronic Communication Policy

This policy is twenty-three (23) page in length, is compliant with all recent legislation (SOX, HIPAA, Patriot Act, and Sensitive information), and covers:

Sensitive Information Policy

This policy covers the treatment of Credit Card, Social Security, Employee, and Customer Data. The policy is 15 pages in length. This policy complies with Sarbanes Oxley Section 404.

Travel and Off-Site Meeting Policy

Data and application security

Minimize attention

Shared public resources

Off-site meeting special considerations

Outsourcing Policy

This policy is seven page in length and covers:

Outsourcing Management Standard

Service Level Agreement

Responsibility

Outsourcing Policy

Policy Statement

Goal

Approval Standard

Base Case

Responsibilities

Latest News

Internet,
E Mail and
Electronic Communication
Policy