Course Outline
Introduction
- Overview of Security Policy Management
- Exploring the objectives and benefits of IT security policies
- The lifecycle and stages of Security Policy Management
Initiating a Security Policy Program
- Establishing a security policy team
- Assessing organizational needs and business risks
- Understanding the organization's legal requirements
- Evaluating existing security software and tools
- Addressing the different levels of the organization
- Choosing the most appropriate Security Policy Management software
Designing a Comprehensive Security Policy Program
- Core objectives of a Security Policy: Confidentiality, Integrity, Availability
- Creating a policy development and implementation checklist
- Defining the objectives, scope, and goals of a Security Policy
- Establishing consequences for non-compliance
- Aligning Security Policies with industry regulations such as PCI DSS, HIPAA, SOX, GLBA, GDPR, etc.
Case Study: Adhering to Industry Regulations
- Financial, health, and other government-regulated sectors
- The importance of centralized forms and templates
Implementing Security Policies
- Addressing critical IT areas: hardware, software, network, data, and users
- Enforcing rules and procedures for accessing IT assets and resources
- Delegating security roles and duties
- Restricting user access
- Maintaining separate policies for different departments within an organization
- Reading, accepting, and signing the Security Policy
- Distinguishing between Privacy Policy and Public Facing Policy
Communicating Security Policies
- Designing Security Policy learning materials
- Disseminating Security Policy information to employees and management
- Conducting security training and workshops
- Updating and adapting the Security Policy
- Cultivating a "Security Culture" within the organization
Contingency Planning
- Responding to security attacks and failures
- Establishing maintenance and recovery strategies
- Responding to litigation "attacks"
Performing Security Testing and Review
- Performing scheduled reviews (yearly, bi-annually, etc.)
- Conducting a formal audit
- Decommissioning obsolete hardware, software, data, and processes
- Removing obsolete or redundant security policies
- Obtaining Security Policy Management certification
Summary and Conclusion
Requirements
- A general understanding of IT security and asset management
- Experience with security policy development and implementation
Audience
- IT administrators
- Security coordinators
- Compliance managers
Testimonials (4)
The trainer was helpful..
Attila - Lifial
Course - Compliance and the Management of Compliance Risk
learning about Basel
Daksha Vallabh - Standard Bank of SA Ltd
Course - Basel III – Certified Basel Professional
Risk optimization is more clear than the other subjects
Munirah Alsahli - GOSI
Course - CGEIT – Certified in the Governance of Enterprise IT
The knowledge and understanding of the trainer on the training material was exceptional. The trainer was well aware of the subject, provided practical examples in relevance. I would highly recommend him as a trainer for this training.
