This
assignment consists of five (5) parts:
Part 1: Organization Chart
Part 2: Request for Proposal (RFP) Plan
Part 3: Physical Security Plan
Part 4: Enterprise Information Security Compliance Program
Part 5: Risk Management Plan
Imagine that you have been recently promoted to serve as Chief Information
Security Officer (CISO) for a Fortune 500 organization. This organization has
known brand products across the world and expects top-secret methods for
safeguarding proprietary information on its recipes and product lines. The
Board of Directors request that their information security strategy be upgraded
to allow greater opportunities of secure cloud collaboration between suppliers
and resellers of their products. Another concern they have is the recent number
of hacktivist attacks that have caused the network to fail across the
enterprise. Their concern extends to making sure that they have controlled
methods for accessing secured physical areas within their various regional
facilities.
For your new position, you will be responsible for developing standards,
methods, roles, and recommendations that will set the new IT security path for
the organization. The existing organization has limited experience in supporting
an enhanced level of IT security; therefore, you may need to outsource certain
security services.
Additionally, you may create and / or assume all necessary assumptions needed
for the completion of this assignment.
Write an eight to twelve (8-12)page paper in which you provide the following deliverables:
Part
1: Organization Chart
1. Use Visio or an Open Source alternative, such as Dia, to:
a. Create an organization chart in which you:
i. Illustrate the roles that will be
required to ensure design, evaluation, implementation, and management of
security programs
for the organization.
ii. Within your organizational chart,
clearly identify the reporting structure for roles such as IT Security
Compliance Officer,
Security Manager, CIO, CISO, IT Security Engineer, Privacy
Security Professional, and IT Procurement Specialist.
iii. List the types of resources required to
fulfill the each forensic duty of the organization below each of the roles you
identified.
iv. Align your organization chart to reflect
the Department of Homeland Security (DHS) Essential Body of Knowledge’s three
(3)
areas of information security: physical security
professional, privacy professional, and procurement professional. Provide
comments and comparisons on how your organizational chart
fosters these three (3) values.
Part
2: Request for Proposal (RFP) Plan
2. Develop a Request for Proposal (RFP) plan to solicit qualified vendors that
could partner with your internal team to deliver optimum
IT service
delivery. The RFP Plan should contain qualifying criteria of potential vendors
and the responsibilities of the vendor once
the contract is
awarded. As part of the plan, you must:
a. Describe at least two (2) perspectives that need to be closely
monitored within the contract.
b. Give your perspective on at least two (2) methods that could
be used to evaluate and develop a qualified trusted supplier list.
Part
3: Physical Security Plan
3. Recommend a physical security plan that could be used to protect sensitive
areas such as telecom rooms, employee only areas,
and
manufacturing facilities in which you:
a. Include at least three (3) specific methods.
Part
4: Enterprise Information Security Compliance Program
4. Establish an enterprise information security compliance program that
addresses the concerns of the board of directors of the
organization in
which you:
a. Describe specific plans and control objectives that could be
adopted to address the known issues.
b. Suggest at least three (3) information security policies that
could be developed and practiced within the organization for data
security assurance.
c. Outline the steps you would take to define the security needs
of the organization in terms of duties, staffing, training, and
processes.
Part
5: Risk Management Plan
5. Develop a risk management plan in which you:
a. Describe at least three (3) possible risk management
efforts that could be used to assess threats and unknown issues.
b. Determine why defining priorities is an important part
of the process when enumerating and having efficient risk control
measures.
c. Suggest specific technical and management controls that
could be enacted in order to monitor risks accurately.
6. Use at least three (3) quality resources in this assignment. Note: Wikipedia
and similar Websites do not qualify as quality
resources.
Your assignment must follow these formatting requirements:
·
Be typed, double spaced, using
Times New Roman font (size 12), with one-inch margins on all sides; citations
and references must follow APA or school-specific format.
·
Include a cover page
containing the title of the assignment, the student’s name, the professor’s
name, the course title, and the date. The cover page and the reference page are
not included in the required assignment page length.
·
Include charts or diagrams
created in Visio or one of its equivalents such as Dia. The completed diagrams
/ charts must be imported into the Word document before the paper is submitted.
The specific course learning outcomes associated
with this assignment are:
·
Describe and apply the 14
areas of common practice in the Department of Homeland Security (DHS) Essential
Body of Knowledge.
·
Describe best practices in
cybersecurity.
·
Describe physical security
plans and processes.
·
Evaluate the ethical concerns
inherent in cybersecurity and how these concerns affect organizational
policies.
·
Explain legal and regulatory
compliance practices.
·
Explain risk management plans
and policies.
·
Describe physical security
plans and processes.
·
Develop a cybersecurity plan
that incorporates the Department of Homeland Security (DHS) Essential Body of
Knowledge.
·
Identify the strategic
management issues in cybersecurity planning and response.
·
Explain data security
competencies to include turning policy into practice.
·
Compare and contrast the
functional roles of an organization in the context of cybersecurity.
·
Identify and analyze the role
of the Chief Information Officer, Information Security Officer, and IT Security
Compliance Officer in the context of cybersecurity.
·
Use technology and information
resources to research issues in cybersecurity.
·
Write clearly and concisely
about topics associated with cybersecurity using proper writing mechanics and
technical style conventions.
