In this assignment, you are to create a security management policy that addresses the management and the separation of duties throughout the seven domains of a typical IT infrastructure. You are to define what the information systems security responsibility is for each of the seven domains of a typical IT infrastructure. From this definition, you must incorporate a definition for the separation of duties into the Procedures section of the policy definition template that you will fill out later in this step. The scenario you are to work with is for the mock XYZ Credit Union/Bank:
* The organization is a regional XYZ Credit Union/Bank that has multiple branches and locations throughout the region
* Online banking and use of the Internet are the bank’s strengths, given its limited human resources
* The customer service department is the organization’s most critical business function
* The organization wants to be in compliance with the Gramm-Leach-Bliley Act (GLBA) and IT best practices regarding its employees
* The organization wants to monitor and control use of the Internet by implementing content filtering
* The organization wants to eliminate personal use of organization-owned IT assets and systems
* The organization wants to monitor and control use of the e-mail system by implementing e-mail security controls
* The organization wants to implement this policy for all the IT assets it owns and to incorporate this policy review into its annual security awareness training
* The organization wants to define a policy framework, including a security management policy defining the separation of duties for information systems security
Create the IT policy, standard, guideline, and procedure for the XYZ Credit Union/Bank organization regarding the use of personal devices (cell phones, tablets, home computers, etc.). All of these may be contained in a single document, but each one should start on a new page.
