Question

As a CISO, you are responsible for developing an information security program based on using a supporting framework. Discuss what you see as some major components of an information security program.

Answer 1

The CISO (Chief Information Security Officer) of an organization should understand the following components of an information security program:

1) Every organization needs a well-documented information security policy that will govern the activities of all persons involved with Information Technology.

2) The organization's assets must be classified and controlled with the best industry practices, procedures, and processes put in place to achieve the organization's IT objectives.

3) There should be proper security screening of all persons in the organization, all hardware infrastructure, and software programs for the organization and those brought in by staff.

4) Access to IT infrastructure must be controlled to ensure compliance with laid-down policies.

Step-by-step explanation:

As the Chief Information Security Officer responsible for the information and data security of my organization, I will work to ensure that awareness is created of current and developing security threats at all times. I will develop, procure, and install security architecture, including IT and network infrastructure with the best security features. There will good management of persons' identity and controlled access to IT hardware. Programs will be implemented to mitigate IT-related risks with due-diligence investigations, and smooth governance policies.