10 Step Security Implementation
Enterprise are challenged to meet compliance requirements for security as the number of threats increase
10 step security implementation process that Janco has utilized successfully in hundreds of organizations includes:
- Make security an executive directive - The driver for security needs to be at the CEO and or the Board of Directors. If they are the drivers the organization will respond accordingly.
- Implement clear security guidelines - Have a published security manual with specific policies, procedures, and statements of what will occur if someone does not follow the rules. A formal Security Manual is a must.
- Provide specifics for security compliance - Do not use statements like "in general" without having specific example of what the individual needs to do. For example, if security badges are used there should be a statement or image of how the badge is worn. If the badge is not visible then it does not not meet the objectives of the seccurity compliance.
- Enforce that everyone follows the rules - If ID badges are require then everyone including the CIO and CEO need to use one. If a level of the organization does not use them then over time lower levels will stop using them.
- Provide formal training program - All new employees should go through this program as soon as they are hired and all existing employees need to have "at least" an annual review of the security guidelines and rules. The program can be written with a signed statement by the individual that states they have read the program and will comply with the enterprise's policies.
- Communicate Security - On an on-going basis communicate what security best practices all employees and associates need to follow. A company newsletter is a great place for security to be highlighted.
- Monitor security compliance - Validate that security rules and guidelines are being followed and make individuals and managers accountable for breaches. In many cases this can be done via software applications for electronic data files. In other case, logs and security videos can be utilized.
- Establish security compliance metrics - Identify metrics that are meaningful to validate that compliance is occurring. Have metrics which show violations to the security guidelines as well as the total breadth and depth of the security process. Whenever a breach at another organization is made public, review what metrics are in place to identify the breach and mitigate it.
- Provide security compliance feedback - At least month provide a general report that show the status of the security program. Communicate with management and staff the successes and failures in the security program
- Audit security with a third party - On an annual basis have a third party audit the security program and validate:
- The program is in place and functional
- The program is being followed
- All of the right things are included
- Business and IT Impact Questionnaire
- Threat and Vulnerability Assessment Toolkit
- Security Management Checklist
- Full Detail Policies for
- Blog and Personal Website Policy
- Mobile Device Policy
- Physical and Virtural File Server Policy
- Sensitive Information Policy
- Travel and Off-Site Meeting Policy
- HIPAA Audit Program
- GDPR Compliance Checklist to meet EU Requirements
- California Consumer Privacy Act requirements definition
- Consumer Bill of Rights
- Sarbanes Oxley Section 404 Checklist
- Security Audit Program- fully editable -- Comes in MS EXCEL and PDF formats -- Meets GDPR, ISO 28000, 27001, 27002, Sarbanes-Oxley, PCI-DSS, HIPAA FIPS 199, and NIS SP 800-53 requirements -- Over 400 unique tasks divided into 11 areas of audit focus which are the divided into 38 separate task groupings
- Electronic forms that can be Emailed, completed via a computer or tablet, and stored electronically including: Blog Policy Compliance, BYOD Access and Use, Company Asset Employee Control Log, Email - Employee Acknowledgment, Employee Termination Checklist, FIPS 199 Assessment Electronic Form, Internet Access Request, Internet Use Approval, Internet & Electronic Communication - Employee Acknowledgment, Mobile Device Access and Use Agreement, Employee Security Acknowledgement Release, Preliminary Security Audit Checklist, Risk Assessment, Security Access Application, Security Audit Report, Security Violation Reporting, Sensitive Information Policy Compliance Agreement, Server Registration, and Threat and Vulnerability Assessment
- eReader version of the Security Manual Template
- Security Team Job Descriptions MS Word Format
- Chief Compliance Officer (CCO); Chief Security Officer (CSO); VP Strategy and Architecture; Data Protection Officer (DPO); Director e-Commerce; Database Administrator; Data Security Administrator; Manager Data Security; Manager Facilities and Equipment; Manager Network and Computing Services; Manager Network Services; Manager Training and Documentation; Manager Voice and Data Communication; Manager Wireless Systems; Identity Management Protection Analyst, Information Security Analyst, Network Security Analyst; System Administrator - Linux, System Administrator - Unix; and System Administrator - Windows
- IT Job Descriptions MS Word Format - Updated to meet all mandated security requirements
- 300 Job Descriptions from the Internet and IT Job Descriptions HandiGuide in MS Word Format including all of the job descriptions in the Premium Edition. Each job description is at least 2 pages long and some of the more senior positions are up to 8 pages in length.
Security Manual Template purchase options
Security Manual Template - Standard Edition
Security Manual Template - Premium Edition
Security Manual Template - Gold Edition