|
REGULATION REQUIREMENT:
|
IMPLEMENTATION MEASURES:
|
|
|
|
|
Contingency plan
|
Applications and data criticality analysis
Data backup plan
Disaster recovery plan
Emergency mode operation plan
Testing and revision
|
|
Information access control
|
Access authorization
Access establishment
Access modification
|
|
Personnel security
|
Supervision of maintenance personnel by authorized, knowledgeable person
Maintain record of authorizations
Personnel have proper access authorization
Personnel clearance procedure
Personnel security policy/procedure
Users trained in security
|
|
Security configuration management
|
Documentation
Inventory
Security Testing
Virus checking
|
|
Security incident procedures
|
Report and response procedures
|
|
Security management process
|
Risk analysis
Risk management
Sanction policy
Written security policy
|
|
Termination
|
Combination locks changed
Remove from access lists
Remove user account(s)
Turn in access items (keys, badge, etc.)
|
|
Training
|
Awareness training for all personnel
Periodic security reminders
User education concerning virus protection
User education in password management
|
