BCEC IT CP 009 Rev.1 Information Technology Security Plan (ITSP)

Procedure No.
: BCEC/IT/CP/009
Effective: 14.06.2016
Issue Date: 14.06.2016
Revision No.: 1
PROCEDURE INFORMATION TECHNOLOGY DEPARMENT
INFORMATION TECHNOLOGY SECURITY

PLAN
Page 1 of 11
INFORMATION TECHNOLOGY SECURITY PLAN

Prepared by IT Department
Approved by Chief Executive Officer
UNCONTROLLED IF PRINTED. This copy was valid at the time it was printed.
 Consider the Environment. Please do not print this document unless you really need to, if you need take duplex. At BCEC we support
conservation.
Procedure No.: BCEC/IT/CP/009
Revision No.: 1
REVISION HISTORY
Revision Date Effective

Issue Date Amendment Description
No. DD/MM/YY
First issue and for implementation of procedure
0 18.11.2015 18.11.2015
on Information Technology Security Plan.
Revised the following Sections:
1 14.06.2016 - 2.0 – ITSP- corrected acronyms; and 14.06.2016
- 8.0 – added two items on means of disposal.
Page 2 of 11

conservation.
Revision No.: 1
TABLE OF CONTENTS
REVISION HISTORY
TABLE OF CONTENTS
1.0 INTERNAL CONTROLS ………………………………………….………………………..………4
1.1 VALIDATION ………...….………………………………………….………………………..………4
1.2 APPROVAL .…………….………………………………………….………………………..………4
2.0 OBJECTIVE……………...………………………………………….………………………..……..5
3.0 PURPOSE..……………...………………………………………….………………………..………5
4.0 SCOPE..………………………………………………….………….………………………..………5
5.0 DATA SECURITY COORDINATOR …………………………….………………………..………5
6.0 INTERNAL RISK MITIGATION POLICIES .…………………….………………………..………6
7.0 EXTERNAL RISK MITIGATION POLICIES……………….……….………………………..…...8
8.0 DAILY OPERATIONAL PROTOCOL.....……………………….……...…………………..…..…8
9.0 BREACH OF DATA SECURITY PROTOCOL….……………….………...……………..…..…9
ATTACHMENT(S)
Attachment A:
Common Business Records Needs/Associated Retention and Secure Destruction Periods
Page 3 of 11

conservation.
Revision No.: 1
1.0 INTERNAL CONTROLS
1.1 VALIDATION
To assure Managements and External Agencies confidence in the BCEC’s policies and
practices; Black Cat Engineering & Construction W.L.L. (BCEC) Internal Audit may verify
without notice, compliance with this Procedure.
The Information Technology (IT) Department shall re-validate this procedure at intervals
not exceeding three years to ensure that it continues to serve the purpose intended and is
updated to reflect changes within the BCEC.
1.2 APPROVAL
This Procedure and any amendments made thereto; require the following approvals:
Authority Date
Page 4 of 11

conservation.
Revision No.: 1
2.0 OBJECTIVE
The objective of Black Cat Engineering & Construction W.L.L. (“BCEC”) in the development
and implementation of this comprehensive Information Technology Security Plan “ITSP”
is to create effective administrative, technical and physical safeguards for the protection of
BCEC information. The ITSP sets forth the procedure for evaluating and addressing the
electronic and physical methods of accessing, collecting, storing, using, transmitting, and
protecting BCEC information.
3.0 PURPOSE
The purpose of the ITSP is to better: (a) ensure the security and confidentiality of BCEC
information; (b) protect against any reasonably anticipated threats or hazards to the
security or integrity of such information; and (c) protect against unauthorized access to or
use of such information in a manner that creates a substantial risk of identity theft or fraud
(d) minimize any opportunities for individuals/organizations to obtain information without
specific authorization.
4.0 SCOPE
In formulating and implementing the ITSP, BCEC has addressed and incorporated the
following protocols:
 Identified reasonably foreseeable internal and external risks to the security,

confidentiality, and/or integrity of any electronic, paper or other records containing
BCEC information.
 Assessed the likelihood and potential damage of these threats, taking into
consideration the sensitivity of the BCEC information.
 Evaluated the sufficiency of existing policies, procedures, customer information

systems, and other safeguards in place to control risks.
 Designed and implemented an ITSP that puts safeguards in place to minimize risks.
 Implemented regular monitoring of the effectiveness of those safeguards.
5.0. DATA SECURITY COORDINATOR

BCEC has designated Data Security Coordinator to implement, supervise and maintain
the ITSP. This designated employee (the "Data Security Coordinator") will be responsible for
the following:
 Implementation of the ITSP including all provisions outlined in Section 8.0: Daily
Operational Protocol.
 Training of all employees.
 Regular testing of the ITSP's safeguards.

Page 5 of 11

conservation.
Revision No.: 1
 Evaluating the ability of any of our third party service providers to implement and
maintain appropriate security measures for the BCEC information to which we have
permitted them access, and requiring such third party service providers by contract to
implement and maintain appropriate security measures.
 Reviewing the scope of the security measures in the ITSP at least annually, or
whenever there is a material change in our business practices that may implicate the
security or integrity of records containing BCEC information.
 Conducting an annual training session for employees and independent contractors,

including temporary and contract employees who have access to BCEC information
on the elements of the ITSP. All attendees at such training sessions are required to
certify their attendance at the training, and their familiarity with our requirements for
ensuring the protection of BCEC information.
6.0. INTERNAL RISK MITIGATION POLICIES
To guard against internal risks to the security, confidentiality, and/or integrity of any
electronic, paper or other records containing BCEC information, and evaluating and
improving, where necessary, the effectiveness of the current safeguards for limiting such
risks, the following measures are mandatory and are effective immediately:
• We will only collect information of clients, customers or employees that is necessary to

accomplish BCEC legitimate business transactions or to comply with any and all local
regulations.
• Access to records containing BCEC information shall be limited to those employees

whose duties, relevant to their job description, have a legitimate need to access said
records, and only for this legitimate job-related purpose.
• Written and electronic records containing BCEC information shall be securely destroyed
or deleted at the earliest opportunity consistent with business needs or legal retention
requirements. Our frequent business records needs and associated retention and
secure destruction periods are included in Attachment A: Common Business Record
Needs [to be completed by Departments after evaluating usual business record
needs].
• A copy of the ITSP is to be distributed to employees and to each new employee on the
beginning date of their employment. It shall be the employee's responsibility for
acknowledging in writing, by signing the attached sheet, that he/she has received a copy
of the ITSP and will abide by its provisions. Employees are encouraged and invited to
advise the ITSP Data Security Coordinator of any activities or operations which appear
to pose risks to the security of BCEC information. If the Data Security Coordinator is
him or herself involved with these risks, employees are encouraged and invited to
advise any other manager or supervisor.
Page 6 of 11

conservation.
Revision No.: 1
• All employment contracts, where applicable, will be amended to require all employees to
comply with the provisions of the ITSP and to prohibit any nonconforming use of BCEC
data as defined by the ITSP.
• Terminated employees must return all records containing BCEC data, in any form, in
their possession at the time of termination. This includes all data stored on any portable
device and any device owned directly by the terminated employee
• A terminated employee's physical and electronic access to records containing BCEC

information shall be restricted at the time of termination. This shall include remote
electronic access to BCEC records, voicemail, internet, and email access. All keys,
keycards, access devices, badges, BCEC IDs, business cards, and the like shall be
surrendered at the time of termination.
• Disciplinary action will be applicable to violations of the ITSP, irrespective of whether

BCEC data was actually accessed or used without authorization.
• All security measures including the ITSP shall be reviewed at least annually to ensure
that the policies contained in the WISP are adequate meet all applicable federal and
state regulations.
• Should our business practices change in a way that impacts the collection, storage,
and/or transportation of records containing BCEC information the ITSP will be reviewed
to ensure that the policies contained in the ITSP are adequate meet all applicable
regulations.
• The Data Security Coordinator or his/her designee shall be responsible for all review
and modifications of the ITSP and shall fully consult and apprise management of all
reviews including any recommendations for improves security arising from the review.
• The Data Security Coordinator shall maintain a secured and confidential master list of all
lock combinations, passwords, and keys. The list will identify which employee possess
keys, keycards, or other access devices and that only approved employee have been
provided access credentials
• The Data Security Coordinator or his/her designee shall ensure that access to BCEC
information in restricted to approved and active user accounts.
• Current employees' user ID's and passwords shall conform to accepted security
standards. All passwords shall be changed at least annually, more often as needed (e.g.
seasonally).
• Employees are required to report suspicious or unauthorized use of BCEC information

to supervisor or the Data Security Coordinator.
Page 7 of 11

conservation.
Revision No.: 1
• Whenever there is an incident that requires notification pursuant to the Security Breach.
The Data Security Coordinator shall host a mandatory post-incident review of events
and actions taken, if any, in order to determine how to alter security practices to better
safeguard BCEC information.
7.0 EXTERNAL RISK MITIGATION POLICIES
• Firewall protection, operating system security patches, and all software products shall
be reasonably up-to-date and installed on any computer that stores or processes
BCEC information
• BCEC information shall not be removed from the business premises in electronic or
written form absent legitimate business need and use of reasonable security measures,
as described in this policy
• All system security software including, anti-virus, anti-malware, and internet security
shall be reasonably up-to-date and installed on any computer that stores or processes
BCEC information.
• There shall be secure user authentication protocols in place that:
o Control user ID and other identifiers:
o Assigns passwords in a manner that conforms to accepted security

standards, or applies use of unique identifier technologies
o Control passwords to ensure that password information is secure.
8.0 DAILY OPERATIONAL PROTOCOL
This section of our ITSP outlines our daily efforts to minimize security risks to any computer
system that processes or stores BCEC information, ensures that physical files containing
BCEC information are reasonable secured and develops daily employee practices
designed to minimize access and security risks to BCEC information of our clients
and/or customers and employees.
The Daily Operational Protocol is effective and shall be reviewed and modified as deemed
necessary at a meeting of the Data Security Coordinator and personnel responsible and/or
authorized for the security of BCEC information. Any modifications to the Daily Operational
Protocol shall be published in an updated version of the ITSP. At the time of publication, a
copy of the ITSP shall be distributed to all current employees and to new hires on their date
of employment.
A. Recordkeeping Protocol:
• Any BCEC information stored shall be disposed of when no longer needed for business
purposes.
Page 8 of 11

conservation.
Revision No.: 1
• Electronically stored records containing BCEC information shall be disposed as follows:
- Electronic media and other non-paper media containing BCEC information shall
be destroyed or erased so that BCEC information cannot practicably be read or
reconstructed.
- Destruction and disposal of electronic media and other non-paper media

containing BCEC records requires prior written approval and authorization of the
CEO and the appropriate Department Manager with reference to Procedure no.
BCEC/FIN/CP/006-Rev.XX-Disposal Of Surplus, Obsolete and Scrap Materials.
- Assigned department’s liaison officer shall accomplish the Declaration Form

BCEC/FIN/QS-002/Rev.XX) and Disposition Form (BCEC/FIN/QS-003/Rev.XX).
B. Access Control Protocol:
• All BCEC computers shall restrict user access to those employees having an authorized
and unique log-in ID assigned by the Data Security Coordinator
• All computers that have been inactive for 15 or more minutes shall require re-log-in
• After 5 unsuccessful log-in attempts by any user ID, that user ID will be blocked from
accessing any computer or file stored on any computer until access privileges are
reestablished by the Data Security Coordinator or his/her designee
• Access to electronically stored records containing BCEC information shall be

electronically limited to those employees having an authorized and unique login ID
assigned by the Data Security Coordinator
• All computers with an internet connections or any computer that stores or processes
BCEC information must have a reasonably up-to-date version of software providing
virus, anti-spyware and anti-malware protection installed and active at all times.
9.0 BREACH OF DATA SECURITY PROTOCOL

Should any employee know of a security breach at any of our facilities, or that any
unencrypted BCEC information has been lost or stolen or accessed without authorization,
or that encrypted BCEC information along with the access code or security key has been
acquired by an unauthorized person or for an unauthorized purpose, the following protocol
is to be followed:
• Employees are to notify the Data Security Coordinator or department head in the
event of a known or suspected security breach or unauthorized use of BCEC
information.
Page 9 of 11

conservation.
Revision No.: 1
• The Data Security Coordinator shall be responsible for drafting a security breach
notification to be provided to the BCEC CEO. The security breach notification shall
include the following:
• A detailed description of the nature and circumstances of the security breach or

unauthorized acquisition or use of BCEC information.
• The steps already taken relative to the incident.
• Any steps intended to be taken relative to the incident subsequent to the filing of the
notification; and Information regarding whether law enforcement officials are
engaged in investing the incident
Page 10 of 11

conservation.
Revision No.: 1
Attachment A:
Common Business Records Needs/Associated Retention and Secure Destruction Periods
Record Time Retained Destroyed On/Destroyed By
Page 11 of 11

conservation.

BCEC IT CP 009 Rev.1 Information Technology Security Plan (ITSP)

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BCEC IT CP 009 Rev.1 Information Technology Security Plan (ITSP)

Uploaded by

Copyright:

Available Formats

Procedure No.

PROCEDURE INFORMATION TECHNOLOGY DEPARMENT

INFORMATION TECHNOLOGY SECURITY

INFORMATION TECHNOLOGY SECURITY PLAN

Revision Date Effective

INFORMATION TECHNOLOGY SECURITY PLAN

INFORMATION TECHNOLOGY SECURITY PLAN

1.0 INTERNAL CONTROLS

INFORMATION TECHNOLOGY SECURITY PLAN

 Identified reasonably foreseeable internal and external risks to the security,

 Evaluated the sufficiency of existing policies, procedures, customer information

 Implemented regular monitoring of the effectiveness of those safeguards.

5.0. DATA SECURITY COORDINATOR

 Training of all employees.

 Regular testing of the ITSP's safeguards.

INFORMATION TECHNOLOGY SECURITY PLAN

 Conducting an annual training session for employees and independent contractors,

6.0. INTERNAL RISK MITIGATION POLICIES

• We will only collect information of clients, customers or employees that is necessary to

• Access to records containing BCEC information shall be limited to those employees

INFORMATION TECHNOLOGY SECURITY PLAN

• A terminated employee's physical and electronic access to records containing BCEC

• Disciplinary action will be applicable to violations of the ITSP, irrespective of whether

• Employees are required to report suspicious or unauthorized use of BCEC information

INFORMATION TECHNOLOGY SECURITY PLAN

7.0 EXTERNAL RISK MITIGATION POLICIES

• There shall be secure user authentication protocols in place that:

o Control user ID and other identifiers:

o Assigns passwords in a manner that conforms to accepted security

o Control passwords to ensure that password information is secure.

8.0 DAILY OPERATIONAL PROTOCOL

INFORMATION TECHNOLOGY SECURITY PLAN

• Electronically stored records containing BCEC information shall be disposed as follows:

- Destruction and disposal of electronic media and other non-paper media

- Assigned department’s liaison officer shall accomplish the Declaration Form

B. Access Control Protocol:

• Access to electronically stored records containing BCEC information shall be

9.0 BREACH OF DATA SECURITY PROTOCOL

INFORMATION TECHNOLOGY SECURITY PLAN

• A detailed description of the nature and circumstances of the security breach or

• The steps already taken relative to the incident.

INFORMATION TECHNOLOGY SECURITY PLAN

Record Time Retained Destroyed On/Destroyed By

INFORMATION TECHNOLOGY SECURITY PLAN

You might also like