Describe at least three possible risk management efforts
Computer Network Security
Term Paper: The Rookie Chief Information Security Officer
This assignment consists of five parts:
Part 1: Organization Chart
Part 2: Request for Proposal (RFP) Plan
Part 3: Physical Security Plan
Part 4: Enterprise Information Security Compliance Program
Part 5: Risk Management Plan
Imagine that you have been recently promoted to serve as Chief Information Security
Officer (CISO) for a Fortune 500 organization. This organization has known brand
products across the world and expects top-secret methods for safeguarding
proprietary information on its recipes and product lines. The Board of Directors
request that their information security strategy be upgraded to allow greater
opportunities of secure cloud collaboration between suppliers and resellers of
their products. Another concern they have is the recent number of hacktivist
attacks that have caused the network to fail across the enterprise. Their concern
extends to making sure that they have controlled methods for accessing secured
physical areas within their various regional facilities.
For your new position, you will be responsible for developing standards, methods,
roles, and recommendations that will set the new IT security path for the
organization. The existing organization has limited experience in supporting an
enhanced level of IT security; therefore, you may need to outsource certain
security services.
Additionally, you may create and / or assume all necessary assumptions needed for
the completion of this assignment.
Write an eight to twelve page paper in which you provide the following
deliverables:
Part 1: Organization Chart
1. Use Visio or an Open Source alternative, such as Dia, to:
a. Create an organization chart in which you:
i. Illustrate the roles that will be required to ensure design, evaluation,
implementation, and management of security programs for the organization.
ii. Within your organizational chart, clearly identify the reporting structure for
roles such as IT Security Compliance Officer, Security Manager, CIO, CISO, IT
Security Engineer, Privacy Security Professional, and IT Procurement Specialist.
iii. List the types of resources required to fulfill the each forensic duty of the
organization below each of the roles you identified.
iv. Align your organization chart to reflect the Department of Homeland Security
(DHS) Essential Body of Knowledge’s three areas of information security: physical
security professional, privacy professional, and procurement professional. Provide
comments and comparisons on how your organizational chart fosters these three
values.
Part 2: Request for Proposal (RFP) Plan
2. Develop a Request for Proposal (RFP) plan to solicit qualified vendors that
could partner with your internal team to deliver optimum IT service delivery. The
RFP Plan should contain qualifying criteria of potential vendors and the
responsibilities of the vendor once the contract is awarded. As part of the plan,
you must:
a. Describe at least two perspectives that need to be closely monitored within the
contract.
b. Give your perspective on at least two methods that could be used to evaluate and
develop a qualified trusted supplier list.
Part 3: Physical Security Plan
3. Recommend a physical security plan that could be used to protect sensitive areas
such as telecom rooms, employee only areas, and manufacturing facilities in which
you:
a. Include at least three specific methods.
Part 4: Enterprise Information Security Compliance Program
4. Establish an enterprise information security compliance program that addresses
the concerns of the board of directors of the organization in which you:
a. Describe specific plans and control objectives that could be adopted to address
the known issues.
b. Suggest at least three information security policies that could be developed and
practiced within the organization for data security assurance.
c. Outline the steps you would take to define the security needs of the
organization in terms of duties, staffing, training, and processes.
Part 5: Risk Management Plan
5. Develop a risk management plan in which you:
a. Describe at least three possible risk management efforts that could be used to
assess threats and unknown issues.
b. Determine why defining priorities is an important part of the process when
enumerating and having efficient risk control measures.
c. Suggest specific technical and management controls that could be enacted in
order to monitor risks accurately.
6. Use at least three quality resources in this assignment. Note: Wikipedia and
similar Websites do not qualify as quality resources.
Your assignment must follow these formatting requirements:
• Be typed, double spaced, using Times New Roman font (size 12), with one-
inch margins on all sides; citations and references must follow APA or school-
specific format. Check with your professor for any additional instructions.
• Include a cover page containing the title of the assignment, the student’s
name, the professor’s name, the course title, and the date. The cover page and the
reference page are not included in the required assignment page length.
• Include charts or diagrams created in Visio or one of its equivalents such
as Dia. The completed diagrams / charts must be imported into the Word document
before the paper is submitted.
The specific course learning outcomes associated with this assignment are:
• Describe and apply the 14 areas of common practice in the Department of
Homeland Security (DHS) Essential Body of Knowledge.
• Describe best practices in cybersecurity.
• Describe physical security plans and processes.
• Evaluate the ethical concerns inherent in cybersecurity and how these
concerns affect organizational policies.
• Explain legal and regulatory compliance practices.
• Explain risk management plans and policies.
• Describe physical security plans and processes.
• Develop a cybersecurity plan that incorporates the Department of Homeland
Security (DHS) Essential Body of Knowledge.
• Identify the strategic management issues in cybersecurity planning and
response.
• Explain data security competencies to include turning policy into practice.
• Compare and contrast the functional roles of an organization in the context
of cybersecurity.
• Identify and analyze the role of the Chief Information Officer, Information
Security Officer, and IT Security Compliance Officer in the context of
cybersecurity.
• Use technology and information resources to research issues in
cybersecurity.
• Write clearly and concisely about topics associated with cybersecurity
using proper writing mechanics and technical style conventions.
