Search results

...ormation requirements, IT configuration, information risk action plans and information security culture into an overall IT security plan. The plan is implemented ...y policy exists and has been approved by an appropriate level of executive management. ...

==FFIEC Information Technology Examination Handbook Executive Summary== ...ve effort of the FFIEC’s five member agencies, has replaced the 1996 FFIEC Information Systems Examination Handbook (1996 Handbook). ...

...1)''' The term '''information security''' means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification ...st improper information modification or destruction, and includes ensuring information non-repudiation and authenticity; ...

...financial resources expended by persons to generate, maintain, or provide information to or for a Federal agency, including the resources expended for—<br> :'''(B)''' acquiring, installing, and utilizing technology and systems; ...

...bility to identify, acquire, install, and maintain appropriate information technology systems.” The process includes the internal development of software applic ...o deliver products or services, maintain a competitive position, or manage information.<br> ...

=='''Vulnerability Management Standard'''== ...jectives for establishing specific standards on the assessment and ongoing management of vulnerabilities.<br> ...

'''Federal Information Security Management Act (FISMA)''' ...the implementation of and compliance with the Federal Information Security Management Act including: ...

...hanges to business processes, technology and skills are assessed. Business management, supported by the IT function, should assess the feasibility and alternativ Insert remediation plan, applicability, or any information that indicates what needs to be done.<br> ...

...igence Directives.''' Protecting Special Access Program Information Within Information Systems policy excerpt: [[Media:JAFAN_6_3.pdf]]<br> :'''Avoid Session Management Pitfalls:''' [[Media:session-management-security.pdf]]<br> ...

== Requirement 12: Maintain a policy that addresses information security. == ::[[Image:Key-control.jpg]][[PCI-12.3.1:|PCI-12.3.1 Explicit management approval.]]<br> ...

...virus control) across the organization to protect information systems and technology from malware (viruses, worms, spy-ware, spam, internally developed fraudule ...shed procedures across the organization to protect information systems and technology from computer viruses. ...

==Security requirements of information systems== ...egory is to ensure that security is an integral part of the organization's information systems, and of the business processes associated with those systems.<br> ...

...mation technology (IT) systems and their performance management and [[risk management]]. The rising interest in IT governance is partly due to compliance initiat ...bility framework to encourage desirable behavior in the use of information technology."''<br> ...

...ding networks, systems, and applications that store, process, and transmit information assets.<br> ...tives established in the [[Sample Asset Management Policy:|'''Sample Asset Management Standard''']], and provides specific instructions and requirements for esta ...

...rization controls over the initiation of transactions, resulting financial information may not be reliable. :::a. [[SOX.2.7.10:|'''SOX.2.7.10''']] Management protects sensitive information— logically and physically, in storage and during transmission—against unaut ...

==Incident Management== ...| Service Level Management]] process area. The first goal of the incident management process is to restore a normal service operation as quickly as possible and ...

...odies, such as an IT strategy committee, to provide strategic direction to management relative to IT, ensuring that the strategy and objectives are cascaded down Insert remediation plan, applicability, or any information that indicates what needs to be done.<br> ...

...ings are well known in hacker communities and easily determined via public information.<br> ...ngs, and disabling of SSID broadcasts. Enable Wi-Fi Protected Access (WPA) technology for encryption and authentication when WPA-capable.]]<br> ...

...bjective of this category is to ensure the correct and secure operation of information processing facilities.<br> ==Communications and Operations Management== ...

...nd followed for all significant changes in applications and infrastructure technology, which addresses unit, system, integration and user-acceptance-level testin Insert remediation plan, applicability, or any information that indicates what needs to be done.<br> ...