The Standard of Good Practice for Information Security

Contents......Page 3
Introduction to the Standard......Page 5
The Standard......Page 7
Benefits of using the Standard......Page 14
Principles and Objectives......Page 15
Overview of Principles and Objectives......Page 18
Security Management......Page 19
Critical Business Applications......Page 29
Computer Installations......Page 36
Networks......Page 45
Systems Development......Page 52
End User Environment......Page 59
Topics Matrix......Page 67
Overview of Topics Matrix......Page 69
Security Management (Enterprise-wide)......Page 81
Area SM1 High-level Direction......Page 84
Area SM2 Security Organisation......Page 88
Area SM3 Security Requirements......Page 95
Area SM4 Secure Environment......Page 102
Area SM5 Malicious Attack......Page 115
Area SM6 Special Topics......Page 124
Area SM7 Management Review......Page 137
Critical Business Applications......Page 141
Area CB1 Business Requirements for Security......Page 144
Area CB2 Application Management......Page 147
Area CB3 User Environment......Page 156
Area CB4 System Management......Page 163
Area CB5 Local Security Management......Page 168
Area CB6 Special Topics......Page 175
Computer Installations......Page 181
Area CI1 Installation Management......Page 184
Area CI2 Live Environment......Page 190
Area CI3 System Operation......Page 201
Area CI4 Access Control......Page 210
Area CI5 Local Security Management......Page 215
Area CI6 Service Continuity......Page 224
Networks......Page 229
Area NW1 Network Management......Page 232
Area NW2 Traffic Management......Page 238
Area NW3 Network Operations......Page 245
Area NW4 Local Security Management......Page 254
Area NW5 Voice Networks......Page 263
Systems Development......Page 267
Area SD1 Development Management......Page 270
Area SD2 Local Security Management......Page 274
Area SD3 Business Requirements......Page 279
Area SD4 Design and Build......Page 287
Area SD5 Testing......Page 296
Area SD6 Implementation......Page 300
End User Environment......Page 305
Area UE1 Local Security Management......Page 308
Area UE2 Corporate Business Applications......Page 315
Area UE3 Desktop Applications......Page 320
Area UE4 Computing Devices......Page 328
Area UE5 Electronic Communications......Page 331
Area UE6 Environment Management......Page 337
Index......Page 345