Question

Question 21 40 pts

(TCO 1) How should an information security policy be introduced within an organization, and who should be involved in the review and approval process?

Answer 1

Following are the ways to successfully introduced the information security policy within an organization are:

1. Identify your risk - This is the first step, where organization have to identify the type of risk in the organization like- information that should be restricted or sending and receiving the inappropriate large files and attachments. The best way to identify the risk in the organization is monitoring or the reporting tool.It is very important that employees should aware about the type of risk and also the company recording there activity for the risk assessment purpose. This will help the organization to make and introduced the information security system in the organization.
2. Learn from others - There are many types of information security policies.which many organization is using.So, it is very important to analyze and choose the best information security policy for your organization.
3. Include the staff in the policy development - While making the information security policy always involve the employees of your organization.by involving the employees will that they are informed about the rules and tools that re in the information security policy.
4. Train your employees - This process will help the organization, the employees informed and understand the policy. This is a very important phase of the information security policy.which allows the employee to discuss the real-world implication of the policy.
5. Install the tools - Having the policy in the organization is another thing and introducing the policy is other thing.By investing in tools will help the organization to introduce the security policy in the organization.
6. So,by the help of these way any organization can successfully introduce the information security policy in there organization.While making the policy and review the process.The four individuals will definitely involve for review and approval process

• the Contract Originator
• the Contract Administrator
• the General Counsel
• Contract Signatory