Explanation and interpretation

with reference to BS7799 Section 6

Resources available from
WWW.PLAN-IT-CONTROL-IT.COM
(MS Word unless otherwise stated)

Job candidates need to be appropriately vetted before they commence employment to reduce the risk of internal staff breaching security.

Once employed, all staff and contractors need to be made aware of their responsibilities in order to help protect against accidental or deliberate security violations.

They should also sign-off acceptance of security policies as part of their contract of employment.

Staff should also be aware of how to respond to security related incidents.

Title: IT Security Guide

Document name: 4-ITSecGuide.doc

Synopsis: A 1 page summary of the key security principles suitable for inclusion within a staff handbook or contractual terms.

Title: Personnel Security Policy

Document name: 4-PersPolicy.doc

Synopsis: A-3 page policy on security for the staff life cycle

Title: Guideline on Confidentiality and Intellectual Property

Document name: 4-ConfAgree.doc

Synopsis: A 1-page summary of points to cover in a confidentiality and intellectual property agreement.

Title: Job Specification for a Security Manager

Document name: 4-JobSpec.doc

Synopsis: A 1-page job specification for the role of IT Security manager. The specification could be divided between more than one existing roles for a non-dedicated IT security function.

Title: Incident Management Policy

Document name: 4-IncidentMgmt.doc

Synopsis: All IT Security related incidents must be reported to management, escalated and logged so as to minimise the risk of further damage and to prevent reoccurrence. All staff must be aware of their responsibilities to reporting or dealing with an IT Security incident.

Title: IT Security Incident Report Form

Document name: 4-IncidentForm

Synopsis: A template form for recording information security related incidents.