Problem
Review the following scenario for the fictional Bankwise Credit Union:
A. The organization is a local credit union that has multiple branches and locations throughout the region.
B. Online banking and use of the internet are the bank's strengths, given its limited human resources.
C. The customer service department is the organization's most critical business function.
D. The organization wants to be in compliance with the Gramm-Leach-Bliley Act (GLBA) and IT security best practices regarding its employees.
E. The organization wants to monitor and control use of the Internet by implementing content filtering.
F. The organization wants to eliminate personal use of organization-owned IT assets and systems.
G. The organization wants to monitor and control use of the e-mail system by implementing e-mail security controls.
H. The organization wants to implement this policy for all the IT assets it owns and to incorporate this policy review into its annual security awareness training.
I. The organization wants to define a policy framework, including a security management policy defining the separation of duties for information systems security.
Create a security management policy with defined separation of duties for the Bankwise Credit Union.
A. Policy Statement
• Define your policy verbiage.
B. Purpose/Objectives
• Define the policy's purpose as well as its objectives.
C. Scope
• Define whom this policy covers and its scope. What elements, IT assets, or organization-owned assets are within this policy's scope?
D. Standards
• Does the policy statement point to any hardware, software, or configuration standards? If so, list them here and explain the relationship of this policy to these standards.
E. Procedures
• Explain how you intend to implement this policy for the entire organization.
F. Guidelines
• Explain any roadblocks or implementation issues that you must overcome in this section and how you will surmount them per defined guidelines. Any disputes or gaps in the definition and separation of duties responsibility may need to be addressed in this section.