Topic Index

A

Acceptable Use
Access codes changed when employee leaves
Access controls to protect information systems
Access privileges change control
Access privileges for users
Access privileges defined by Managers
Access privileges revoked
Access to systems
Access terminated
Allocation of portable communications devices
Anti Virus software must be installed
Approval for connecting remote devices to systems
Archive Document Retention Form
Archive Procedure
Auditing compliance to Policies
Audit log for recording login details
Audit of systems identify security risks
Authentication required before access

B

Backup of corporate data
Backup of data held Departmentally
Backup of portable devices
Backup Log
Backup Procedure
Blackberry Configuration Guidelines
Blackberry Devices - Use of
Business continuity plan developed by Information Services Manager
Business continuity plan preparation
Business continuity plan supports standard installations

C

Change control for updating system and application software
Collection and use of personal information
Computer equipment isolated from third party equipment
Computer room secured
Confidential information not to be disclosed
Confidentiality leak incident handling procedure
Construction of computer facilities

D

Deletion or falsification of Files (unauthorised) incident procedure
Dual responsibility for critical tasks

E

Email etiquette breaches
Email mailbox size restricted
Email messages retained as corporate records
Email messages saved in corporate directories
Email message to include disclaimer
Email system for business use only
Email system must include SPAM filtering and control
Email system not private
Email use requires approval
Email use by staff is managers responsibility
Employee Acceptance Form
Encryption keys - design and generation
Encryption key management
Encryption keys must not be disclosed
Encryption keys protected during use
Encryption standards
Encryption - when to use it
Environmental controls for computer equipment

F

File deletion (unauthorised) or falsification incident handling procedure
Firewall configuration must not be changed without approval
Firewall required where site to site VPN tunnels exist

G

Group passwords are not permitted

H

Hardware disposal
Hardware evaluated before purchase
Hardware inventory undertaken annually
Hardware purchase
Hardware support for critical systems

I

Incident Reporting
Information accuracy responsibility of management
Information archives subject to standard record keeping principles
Information collection and dissemination in accordance with policy
Information custodians to maintain directories
Information deletion
Information disclosure incident handling procedure
Information originals and source documents
Information ownership
Information release to be approved
Information saved in corporate directories
Insure against security risks
Intellectual property rights
Interfering with computer systems prohibited
Internet connections only through approved corporate channels
Internet for business use
Internet misuse
Internet users must not visit or download from objectionable websites
Introduction of malicious code incident handling procedure
Inventory of key IT positions
ISO 27002
ISO 27002 Policy Compliance Index

J

K

L

Legal compliance
Log off is required if workstation is left for more than one hour
Lost authentication token

M

Maintenance site log
Monitoring login attempts
Monitoring system use

N

Network command initiation
Network configuration information restricted
Network diagram of connection points
Non-Compliance
Notification of all conditions likely to cause disruption to business

O

One time, two factor authentication for remote access
Operating system patches to be installed promptly

P

Password composition
Password changes - forced
Password disclosure incident procedure
Passwords not hardcoded
Passwords not to display onscreen
Password supplied by vendor
Payment Card Industry Data Security Standard (PCI-DSS)
Procedure for handling breach of confidentiality or information disclosure
Procedure for handling deliberate deletion or falsification of electronic records
Procedure for handling lost login tokens
Procedure for handling password disclosure
Procedure for handling spyware or malware
Procedure for handling the introduction of malicious code
Procedure for handling unauthorised access to secure area
Procedure for handling unauthorised removal of equipment
Procedure for handling Virus infection
Procedure for installing operating system patches, fixes and updates
Procedure for Backup
Procedure for Archiving
Procedure for Restoring files from backup
Procedure for providing temporary file server
Procedures for handling security breach to be developed

Q

R

Remote access audit
Remote access authentication
Remote access connection configuration
Remote access during hours specified
Remote access links encrypted
Remote access for vendors disabled by default
Remote access requires approval
Remote access support - access to premises
Remote access support for listed equipment
Remote access to suppliers not automatic
Remote access training
Remote administration
Removing equipment from premises
Report lost ID badges or door passes
Restore Data from Backup Procedure

S

Security breach not to be reported publicly
Security Incident Handling Procedures
Security Incident Log
Significant processing errors to be reported
Software developers access to live systems
Software licence agreements with third parties
Software provided by vendors subject to testing
Software requires formal change control process
Special access login required for computer systems
Special access restricted
Spyware/Malware removal procedure
Standard corporate applications only
System documentation sensitive and confidential
System software updates, fixes and security patches

T

Thin-client computing environment
Third party access approval

U

Unauthorised access to systems prohibited
Unauthorised access incident procedure
Unauthorised removal of computer equipment
Use of Computer Systems, Networks and Equipment
User ID must not be shared

V

Virus generation
Virus infection incident procedure
Voicemail not to be used for sensitive information

W

Webservers not to store critical information
Webservers require firewall protection
Wireless sessions encrypted
Working in a secure area

X

Y

Z

© 2004 All Rights Reserved Kaon Security Ltd