IS0 27002 Standard 10.1.2

IS0 27002 Standard 14.1.1

SIGS Chapter 1 Security Policy 15-17

SIGS Chapter 8 Communications and Systems

    Security Management 8

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard 12.3.7

Supporting non standard equipment is a nightmare, particularly in the event of an emergency situation.  Relevant in-house expertise may not be available.....

       

IS0 27002 Standard 9.2.4

IS0 27002 Standard 10.1.2

IS0 27002 Standard 12.6.1

SIGS Chapter 6 Contractors and Other Third

    Party Access 5

SIGS Chapter 8 Communications and Systems

    Security Management 8

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard No Match

This policy provides for the support of critical computer systems including those that supply status information relating to infrastructure.   It ensures that support staff are alerted to any breakdown or malfunction which could have expensive consequences for the organisation....

       

IS0 27002 Standard 6.1.3

IS0 27002 Standard 8.2.2

SIGS Chapter 2 Security Organisation 24-25

SIGS Chapter 2 Security Organisation 26

SIGS Chapter 2 Security Organisation 27

SIGS Chapter 5 Personnel Security 3

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard No Match

Security is easily compromised by staff or external contractors that lack knowledge on the equipment that they are required to manage and maintain.  Incorrect configuration is one of the prime reasons that systems can be compromised.  When employing new staff it is important that a background check is carried out and that proficiency tests are undertaken to confirm the level of technical expertise is adequate for performing the required tasks.

       

IS0 27002 Standard 10.1.2

IS0 27002 Standard 10.3.1

IS0 27002 Standard 10.3.2

SIGS Chapter 8 Communications and Systems

    Security Management 90-96

SIGS Chapter 9 Control of Access to 

    Information 38

     BS 25999 Standard No Match

SOX Section 404 - 2.1

PCI DSS Standard No Match

The intention of this policy is to prevent the cheapest equipment being purchased where this could have system and security implications.  “Named” brands have usually been extensively tested and documented according to a predefined set of both functionality and security objectives and statistics such as “declared mean time between failures” will be available....

       

IS0 27002 Standard 7.1.1

IS0 27002 Standard 12.6.1

SIGS Chapter 3 Information Classification 2

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard No Match

The intention of this policy is to compel management to prepare an annual inventory of information systems hardware, equipment, devices and anything else that makes up the network and communications infrastructure.  This policy has several advantages.  Only by knowing what system components exist can The Fake Chicken Company properly plan for disasters....

       

IS0 27002 Standard 9.2.6

SIGS Chapter 8 Communications and Systems

    Security Management 30

SIGS Chapter 8 Communications and Systems

    Security Management 38-42

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard No Match

This policy states who is ultimately responsible for the disposal of equipment even though this task may be delegated.  It also seeks to emphasise that the correct procedures must be followed....

       

IS0 27002 Standard 10.7.3

IS0 27002 Standard 10.7.4

IS0 27002 Standard 11.6.1

IS0 27002 Standard 14.1.1

SIGS Chapter 8 Communications and Systems

    Security Management 47

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard 12.5.5

This policy seeks to protect the company from the threat of an unauthorised person using the system documentation to reconfigure hardware components as a means to circumvent network security.....