March 23 2023

Information Assurance Policies

Group 2

Pamela Angelica Palisoc

Jhon-jhon Abad
Joe-an Garrovillo
 Overview
Information assurance policies
Encompass measures that protect and defend information
and information systems by ensuring their availability,
integrity, authentication, confidentiality, and non-
repudiation.

Information security policies, a subset of information

assurance, are designed to ensure users and networks
meet minimum IT security standards, addressing data
protection, user access control, and compliance with legal
and regulatory requirements like NIST, GDPR, HIPAA, and
FERPA
 Key components of an information assurance
Purpose
Clearly outline the purpose of the
policy, which should include
preserving the organization's
information security, detecting and
preempting breaches, protecting the
organization's reputation, upholding
ethical, legal, and regulatory
requirements, protecting customer
data, and responding to security-
related complaints and queries
Audience
Define who the policy applies to and
who it does not apply to, ensuring that
all users within the organization and
its networks are covered. Consider
including third-party and fourth-party
risks in the policy to address potential
vulnerabilities from external sources
Information
Security
Objectives
Define the goals management has
agreed upon and the strategies
used to achieve them, focusing on
the CIA triad - Confidentiality,
Integrity, and Availability of data and
information systems.
 Key components of an information assurance
Authority and
Access Control
Policy:
Specify who has the authority to
decide data sharing, outline access
control levels, handle sensitive
information, define security controls,
and establish acceptable security
standards. Include network security
policies and authentication
requirements like strong passwords,
biometrics, and access tokens
Data
Classification
Classify data into categories based on
sensitivity, such as public information,
confidential data, and critical
information. Implement increasing
levels of protection based on the data
classification to ensure appropriate
security measures are in place
Data support
and
operations
Data protection regulations —
systems that store personal data, or
other sensitive data
Data backup — Encrypt data backup
according to industry best
practices, both in motion and at
rest
Movement of data — Only transfer
data via secure protocols.
 Key components of an information assurance
Security
awareness and
behavior
Share IT security policies with your
staff. Conduct training sessions to
inform employees of your security
procedures and mechanisms,
including data protection measures,
access protection measures, and
sensitive data classification.
Social engineering
Clean desk policy
Encryption
policy
Encryption involves encoding data to
keep it inaccessible to or hidden from
unauthorized parties. It helps protect
data stored at rest and in transit
between locations and ensure that
sensitive, private, and proprietary data
remains private. It can also improve
the security of client-server
communication
Data backup
policy
A data backup policy defines rules
and procedures for making backup
copies of data. It is an integral
component of overall data
protection, business continuity, and
disaster recovery strategy
 Key components of an information assurance
Responsibilities,
rights, and duties
of personnel
Appoint staff to carry out user access
reviews, education, change
management, incident management,
implementation, and periodic
updates of the security policy.
Responsibilities should be clearly
defined as part of the security policy
System
hardening
benchmarks
The information security policy should
reference security benchmarks the
organization will use to harden
mission-critical systems, such as the
Center for Information Security (CIS)
benchmarks for Linux, Windows
Server, AWS, and Kubernetes
References to
regulations and
compliance
standards
The information security policy should
reference regulations and compliance
standards that impact the organization, such
as the General Data Protection Regulation
(GDPR), California Consumer Privacy Act
(CCPA), Payment Card Industry Data Security
Standard (PCI DSS), the Sarbanes-Oxley Act
(SOX), and the Health Insurance Portability
and Accountability Act (HIPAA).
 Information assurance policies that organizations can implement

Information Security Policy (ISP)

An ISP outlines an organization's security rules, regulations, and strategies for maintaining the confidentiality, integrity, and
availability of critical data. It addresses all aspects related to enterprise data security, including the data itself and the
organization's systems, networks, programs, facilities, infrastructure, internal users, and third-party users.

Network Security Policy

This policy outlines who can have access to company networks and servers, as well as what authentication requirements
are needed, including strong password requirements, biometrics, ID cards, and access tokens. It helps in controlling and
securing access to critical IT assets within the organization.

Data Classification Policy

Organizations should classify data into categories based on sensitivity, such as public information, confidential data, and
critical information. This policy ensures that appropriate security measures are in place based on the classification of data,
enhancing data protection and security.
 Information assurance policies that organizations can implement

Access Control Policy

An access control policy defines the level of authority over data and IT systems for every level of the organization. It outlines
how to handle sensitive information, who is responsible for security controls, and what security standards are acceptable.
This policy helps in managing and controlling access to key information technology assets within the organization

Incident Response Policy

This policy outlines step-by-step actions to be taken in response to security incidents. It helps the cybersecurity team
proactively address potential risks and vulnerabilities, enabling the organization to respond promptly to security incidents
and mitigate their consequences
 NIST, GDPR, HIPAA, and FERPA
NIST
stands for the National Institute of Standards and
Technology, which is a non-regulatory federal agency
within the U.S. Department of Commerce. NIST
develops and issues standards, guidelines, and best
practices to promote innovation and industrial
competitiveness in various sectors, including
cybersecurity
HIPAA
stands for the Health Insurance Portability and
Accountability Act, a U.S. federal law enacted in 1996.
HIPAA includes provisions that establish standards for
protecting sensitive patient health information
known as Protected Health Information (PHI). It sets
rules for healthcare providers, health plans, and
healthcare clearinghouses to safeguard PHI and
ensure patient privacy
GDPR
refers to the General Data Protection Regulation, a
European law that came into effect on May 25, 2018.
GDPR aims to protect the privacy and security of
personal data of individuals within the European
Economic Area (EEA) by regulating how
organizations collect, store, process, and transfer
personal data
FERPA
stands for the Family Educational Rights and
Privacy Act, a U.S. federal law that protects the
privacy of student education records. FERPA applies
to educational institutions that receive funding from
the U.S. Department of Education and regulates the
disclosure of student records and access to them
 Sources
https://www.unitrends.com/blog/information-assurance
https://www.itgovernanceusa.com/information/information-assurance
https://www.upguard.com/blog/information-security-policy
https://www.ekransystem.com/en/blog/information-security-policies
https://www.doi.gov/ocio/policy-mgmt-support/info-assurance
https://www.itgovernanceusa.com/information/information-assurance
https://sdi.ai/blog/5-principles-of-information-assurance/
https://www.exabeam.com/explainers/information-security/the-12-elements-of-an-information-
security-policy/
https://www.gvsu.edu/irb/ferpahipaagdpr-54.html
https://kb.wisc.edu/security/page.php?id=104454
https://www.pentasecurity.com/blog/4-data-compliance-standards-gdpr-hipaa-pci-dss-ccpa/
March 23 2023

End of Presentation

THANKYOU