Enterprise Information Security Policy Paper

A good information security policy will take the mission of the company into consideration, the risks that the company faces, the protection of critical assets, and the effect that an attack would have on the organization if one occurred. Developing a security policy does not have to be marred with challenges, it is important that the roles and responsibilities throughout the organization are known, as well as a detailed accounting of what the policy will cover. Hence, an enterprise information security policy should establish and develop critical controls to reduce security risks to the organization, and must be compatible with state and federal regulations. In addition, an enterprise information security policy also integrates and formulates …show more content…
Texas Health and Human Services (HHS) has an Enterprise Information Security Policy that states that the main goal of their information security is to protect the availability, integrity, and confidentiality of information and information resources. In addition, their policy sates that the document structure is established by using security policies, controls, guidelines, practices, and procedures. Thus, another important aspect is that the management has created an all-inclusive information security program throughout the organization through the enforcement, publication, review, and monitoring of the standard information systems security policy. Moreover, the security policies are meant for HHS employees, third-party vendors, and any contractors who utilized the organization’s IT resources. Likewise, more important aspects are Audit and Accountability, Security Assessment and Authorization, Configuration Management, Contingency Planning, Identification and Authentication, Incident Response, Maintenance, Media Protection, Physical and Environmental Protection. Additionally, Personnel Security, Risk Assessment, System and Services Acquisition, System and Communication Protection, System and Information Integrity, and policy exceptions. Hence, the policy is used to ensure that all users who conduct any business and use any technical or are privy to any sensitive information knows the rules, regulations, and policies before accessing any HHS resources. Further, every HHS department must categorize their information system level by assessing the impact that access can have on availability, integrity, and confidentiality of the systems. Thus, this process will ensure that everyone is granted the rights for the appropriate security levels. Moreover, the policies are also utilized to show the roles and responsibilities for key personnel, and details the mission of