Posted: April 1st, 2016

create an Information Security Policy Document policy and an Informational Security Infrastructure policy that incorporate current practices and attitudes as well as the consultants findings and recommendations.

A security consulting firm was hired to assess the Federal Agency of Debt compliance with ISO 17799. They began the process by evaluating the Security Policy document and the Organizational Structure. Listed below are their findings: The Office of the Secretary of Federal Debt is committed to building and supporting a secure environment for information assets. Management throughout the Agency recognizes the need for security process and procedures. The general consensus is that security controls are currently lacking or are inadequate. There is significant concern in regard to confidentiality issues as they relate to regulations and public trust. There is no agency wide security policy; however, there are departmental policies. There is no agency wide security training. There is no agency requirement for employees to acknowledge the acceptable standards of behavior in regard to information security. However, individual departments have implemented confidentiality agreements. Implementation of internal technical security controls is the domain of the Office of Information Technology. The Federal Department of Information Services (a separate Federal Agency) provides and manages Internet access and connectivity, including external e mail services to a private company. Security reviews are conducted as required by law. One of the recommendations of the last review was creating the position of Information Security Officer. You have been asked to create an Information Security Policy Document policy and an Informational Security Infrastructure policy that incorporate current practices and attitudes as well as the consultants findings and recommendations.