Explanation and interpretation

with reference to BS7799 Section 4

Resources available from
WWW.PLAN-IT-CONTROL-IT.COM
(MS Word unless otherwise stated)

Information Security needs to be managed either as a part time role, or by a dedicated member of staff or department. The nature of the IT Security organisation will depend upon the scale of the business and other factors but the following need to be addressed:

¨ IT Security will need representation from across the business including HR; 

¨ Staff will need to be assigned appropriate responsibilities for IT Security;

The resources in this section will provide the documentation for managing IT Security within the organisation

Since some IT function may be outsourced it is appropriate that this section addresses how Information Security should be managed in respect of third party access and outsourcing.

Title: Information Security Department Terms of Reference 

Document name: 2-ITSecTOR.doc

Synopsis: A 2 page template Terms of Reference for a corporate Information Security Function.

Title: Information Security Forum Terms of Reference

Document name: 2-ITSecForumTOR.doc

Synopsis: A 2 page template Terms of Reference for a corporate Information Security Forum or Committee including example forum meeting agenda.

Title: IT Security Management Policy

Documents: 2-ITSecMgmtPol.doc

Synopsis: A 4-page policy covering roles and responsibilities for managing security within the business.

Title: Third Party Access Policy

Document name: 2-ThirdPartyAcc.doc

Synopsis: A 2 page template policy defining the security related requirements for a third party such as for support purposes, that will be accessing corporate data, systems and networks.

Title: Outsourcing Policy

Document name: 2-Outsource.doc

Synopsis: A 4 page policy covering the approach to determining the security requirements for an outsourcing contract agreement.