These enable readers to identify the particular safeguards that are appropriate to their particular business or specific area of responsibility.
ISMS Standards Overview
The scope of any ISMS includes
1. People
2. Processes
3. IT systems
4. Policies
Concerns
- Confidentiality
- Integrity
- Availability
BS7799-2:2002 is a management standard, and explains how to build, maintain and improve an Information Security Management System (ISMS). It is predicated on risk assessment and the Plan-Do-Check-Act model, which are two vital ingredients of corporate governance. Thus, BS7799-2:2002 provides an excellent basis on which to build the management controls necessary to achieve an organization’s mission, to manage risk, to assure effective control and to seek improvements where appropriate. ISMS forms a part of an organization’s internal control system. The 7799 standards are particularly pertinent to corporate governance in an "e-biz" context, where risk management not only has to contend with the usual risks of doing business but also with rapidly changing IT/Internet risks and multiple legal jurisdictions. Thus the standards explain how to address the all-to-common and often devastating business impacts caused by viruses, web-site outages, improper disclosure of customer account details and incorrect pricing information. A growing number of politicians and leaders of industry are now recognizing the importance of these standards. Businesses, notably throughout Europe and Asia, who have a desire to flourish in the Information Age, are already taking advantage of ISO/IEC 17799.
Document and Data Control Procedure
- Information Security Manual
- Asset List/Risk Management Plan
- Statement of Applicability
- Guidelines
- Templates and Formats.
Goals of ISMS
Define and implement process and policies that protect our business assets and ensures efficient business operations and business continuity. Track and keep space with changing requirement of business and threat scenarios. Meet statutory requirements and implement security solution that are cost effective and that afford ease of use for meeting our information goal.
Security Policy
- Protect confidentiality, Integrity and availability of our business
- Meet contractual obligations on information security
- Meet regulatory and legislation requirements
- Ensure business continuity
- Undertake proactive actions and implement relevant information security policies to prevent security breaches
FAQ
1.What is ISMS ?
Information Security Management System, it mainly deals with protecting business assets.
What are business Assets ?
- Information. Database, System Documents, training materia, so on.
- Software. Developed and bought.
- Documents. Hard copy & softcopy, viz. Contracts, manuals, so on.
- People. Employees.
- Services – UPS, Power, so on
- Company Image and Reputation
What are the three concern properties of ISMS?
- Confidentiality. Ensuring that information is accessible to authorized access.
- Integrity. Safe guard the accuracy and completeness of information.
- Availability. Ensuring that authorized users have access to information.
Do you have internal audit?
Yes we have it once in every quarter
How is the audit conducted?
It is conducted by the Information Security officer. They investigate and recommend corrective ness/Preventive actions according to ISMS norms and close the same when they are resolved.
How do you protect sensitive data?
Any information that is considered sensitive will be password protected.
What is password policy?
- Every employee has to secure his password strictly, do not reveal it even to family member while working at home.
- Should not reveal it even to the CEO of the company.
- Password changes after every 45 days.
- Min length of password is of 8 Characters, with a combination of upper case, lower case and punctuation characters as well as letters.
- Should not have names like family members, pets, friends, coworkers, fantasy characters, computer terms, birth day.
What policies should not be violated?
- Copy Rights
- Trade secret
- Patents or Intellectual Properties
- Inappropriate licenses
Can we provide information to others outside company?
No, we should not provide information to other parties outside company.
What will you do when you find some sensitive documents in the office premises or some body violating the rules?
Inform it to the BCP (Business Continuity Plan) representatives of that month.
Are you permitted to bring outside material in the office premises?
No, you are not permitted to bring inside the office, we leave it at the security guard.
What will you do when fire breaks or there is an earth quack?
Don't panic; take proper steps to avoid calamities. Prepare yourself through mock-up drill.
What will you do when virus attacks your system?
We will first remove the network cable or shutdown the system and inform to the network administrator.
What is your asset Manager?
We maintain all the information in the VSS (Virtual Storage System) and access to VSS is given according to the need of the user.
What is HIPAA?
Health Insurance Portability and Accountability Act. Information should be protected as it deals with Health based information.
Were you given an induction, when you joined the company?
Yes.
