PM-2 Information Security Program Leadership Role. Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program
Information Security Program Leadership Role. Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security .
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Appointment record for the senior agency information security officer, naming the individual and the date · Document repository
governing documentDocuments that govern the control
- Documentation of the mission and resources assigned to the role, including staffing and budget · Policy repository / GRC workspace
- Position description or charter setting out the authority to coordinate, develop, implement and maintain the organisation-wide information security programme · Policy repository / GRC workspace
- Evidence the officer exercises the role, such as approval of the information security program plan and of risk decisions · Policy repository / GRC workspace
- Reporting line showing the officer's access to the head of the organisation · Document repository
First move
Common gaps auditors find
- Role held as a secondary duty by an information technology manager, so it lacks the independence and authority the control assumes
- Appointed with a title but no resources, leaving the programme unimplementable
- Officer not involved in the security programme artefacts they are accountable for, so accountability exists only on the organisation chart
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-1 Information Security Program Plan. Develop and disseminate an organization-wide information security program plan that: Provides an overview of the requirements for the security program and a description of the security program management controls and · PM-3 Information Security and Privacy Resources. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; Prepare documentation required for