Information Security Management (Week 3).Final Test Paper .

Information Security Management (Week 3).Final Test Paper
2026\2027.




Chief Information Security Officer (CISO)
In charge of the security management team typically
reports to the Chief Information Officer (CIO).
Chief Information Officer
Responsible for the IT function
Information Security Management "The Six P's"
1. Planning
2. Policy
3. Programs
4. Protection
5. People
6. Project management
3 general information security policies
1. Enterprise information security policy (EISP)
2. Issue-specific security policies (ISSPs)
3. Systems-specific policies (SysSPs)
Enterprise Information Security Policy (EISP)
Developed within the context of the strategic IT plan, this
sets the tone for the info sec department and the InfoSec
climate across the organization. The CISO typically drafts
the program policy, which is usually supported and singed
by the CIO or the CEO.

, Information Security Management (Week 3).Final Test Paper
2026\2027.




Issue-specific security policies (ISSPs)
These are sets of rules that define acceptable behavior
within a specific organizational resource, such as e-mail, or
internet usage
Systems-specific policies (SysSPs)
A merger of technical and managerial intent, SysSPs
include both the managerial guidance for the
implementation of a technology as well as the technical
specifications for its configuration.
Programs
infosec operations that are specifically managed as
seperate entities
(SETA) Program
security education, training, and awareness
Risk management program
include the identification, assessment, and control of risks
to information assets.
Physical security program
complete with fire protection, physical access, gates, and
guards
Protection