ISO 27001:2022 Clause 5 Leadership

Pretesh Biswas Uncategorized August 1, 2019February 5, 2023 46 Minutes

Audio version of the article

Advertisements

This clause places requirements on ‘top management’ which is the person or group of people who directs and controls the organization at the highest level. Demonstrating leadership in regard to the ISMS is a core aspect of the IEC 27001 standard. Note that if the organization that is the subject of the ISMS is part of a larger organization, then the term ‘top management’ refers to the smaller organization. The purpose of these requirements is to demonstrate leadership and commitment by leading from the top. A particular responsibility of top management is to establish the information security policy, and the standard defines the characteristics and properties that the policy is to include. Finally, the clause places requirements on top management to assign information security-relevant responsibilities and authorities, highlighting two particular roles concerning ISMS conformance to ISO 27001 and reporting on ISMS performance. It is essential that top management provide the appropriate level of leadership in terms of direction, authority, policy, governance, and organization. Good leadership deﬁnes the business purpose of information security creates the mission statement, sets the strategy, provides staff focus on what is important with regard to the information security for the business and what the priorities are, motivates and inspires conﬁdence and trust in the workforce that it is committed to protecting the business and nurtures security culture and security skills. Good ISMS leadership is needed to build a team that will successfully take forward the implementation of the ISMS, which will empower and motivate staff to be proactive followers and supporters in helping to protect the organization. A good ISMS leader will be passionate about being successful in managing the information security risks the organization faces. ISMS leadership should strive to inspire others to see information security as a business enabler, with the vision of turning information security risks into a business opportunity. Leadership is different than management—the former motivates and inspires, creates the vision and points people in the right direction, while the latter administers, controls, and follows the vision and organizes people. Both ISMS leadership and ISMS management together achieve an effective, robust, resilient ISMS. Leadership will be the champion of the ISMS, and management will control and manage the ISMS.

The “Leadership” clause has three sub-clauses ie
Clause 5.1 Leadership and Commitment
Clause 5.2 Policy
Clause 5.3 Organizational roles, responsibilities and authorities.

Advertisements

5.1 Leadership and commitment

Top management must demonstrate leadership and commitment by ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organization. The top Management must ensure the integration of the information security management system requirements into the organization’s processes. The top Management must make available the resources needed for the information security management system. The top management must communicate the importance of effective information security management and of conforming to the information security management system requirements. The top Management must ensure that the information security management system achieves its intended outcome which preserves the confidentiality, integrity, and availability of information by applying a risk management process and gives confidence to interested parties that risks are adequately managed. Top Management must direct and support persons to contribute to the effectiveness of the information security management system. They must also support other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility. They must promote continual improvement.

Advertisements

The organization’s Top Management must provide leadership and show their support for ISMS. They must demonstrate a commitment to ISMS. Ensure that ISMS policies are established. Ensure that ISMS objectives are established. Ensure that ISMS achieves its intended outcomes. Ensure that ISMS requirements become an integral part of the organization’s processes. Ensure that necessary ISMS resources are available when they are needed. Must communicate a commitment to ISMS. Make sure that people understand how important information security actually is. Encourage managers to demonstrate their leadership and commitment to information security within their own areas.

Implementing a Security Strategy

An effective information security strategy for an organization must take into account the overall strategic objectives of the Organization. Even when focusing on critical processes and legal mandates, it is necessary to extend protective measures beyond the underlying IT systems and associated administrative staff. For example, the marketing department has access to customer records, and this access must be considered when assessing the security risks associated with these data. A failure to provide marketing executives with securely configured workstations increases the risk of sensitive data being exposed via their computers. This risk can also be reduced by implementing a middleware solution to properly control which records each executive can access and to minimize the amount of sensitive data stored on their computers. Also, to be effective, security practices cannot rely completely on technological solutions. Continuing the example, policies are required to clearly define each employee’s responsibilities relating to s data and the security of their workstations. Also, awareness programs aimed specifically at employees and their responsibilities to safeguard information might be developed, possibly in conjunction with the CISO(Chief Information Security Officer)
To complicate matters, the operational needs of the Organization often directly conflict with security practices such as perimeter firewalls, port authentication, centralized configuration management, and strong authentication. Organizational networks must, therefore, be designed to balance security and privacy requirements while accommodating a wide variety of end-users and their needs – e.g., visitors, new employees arriving with computers, employees sharing large quantities of data with members of the organizations, remote access to a variety of network services for individuals who are traveling or telecommuting, and mobile users moving between classrooms, libraries, and indoor and outdoor study spots on campus. Although firewalls are becoming widely used to protect critical systems on organization’s networks, their use at the perimeter is less common because it is difficult to reconcile their restrictiveness with the need for an open networking environment that supports research, learning, and high-speed networking. Although centralized management is feasible for certain hosts on organizations’ networks, this approach is not suitable for most computers and many systems. In the end, security and privacy practices need to be integrated into operational practices in a way that makes the most sense.

Effective Organizational governance of the information security function is critical to a successful program. It can be both the “proof of the pudding…” with regard to management commitment and provide necessary guidance when deciding where to allocate scarce resources. This well-researched section draws from experts in the field and provides useful background and advice which can be adapted to a wide variety of cultures.

Advertisements

5.2 Policy

Top management must establish an information security policy which has to be appropriate to the purpose of the organization and must include information security objectives or provides the framework for setting information security objectives. It must also include a commitment to satisfy applicable Information Security requirements and a commitment to continual improvement of the information security management system. The policy must be documented , communicated within the the organization and as appropriate made available to interested parties, .

Advertisements

The organization must establish an information security policy for the organization. The Top Management must ensure that information security policy is appropriate and supports the organization’s purpose. The information security policy must include security objectives or can be used to establish these objectives. The information security policy must make a commitment to comply with all relevant information security requirements. An important aspect of conformance to the requirements of ISO 27001 and of achieving a successful ISMS development and implementation and ongoing management is that such task should be driven and led from the top, by top management. Top management should start by deﬁning an appropriate information security policy for the ISMS. The policy should be a clear management statement of its intentions, objectives, and goals regarding information security and the protection of its information systems. This policy should reﬂect top management commitment and support for the ISMS to satisfy the requirements in Section 4.1 and address the issues in Section 4.2. It should be a directive from above that typically should address at least the following:

The scope of information security, its importance to the business, and clarity about what the business information security objectives are (e.g., regarding the protection of the conﬁdentiality, integrity, and availability of its information);
The need for stall awareness: stall should be aware of their duties and responsibilities regarding the risks (e.g., their responsibility to handle and process sensitive company information in a way that protects it from compromise);
What is acceptable and not acceptable with regard to behavior and use of its resources (e.g., acceptable use of the company email system);
Its obligations to carry out its business in compliance with the laws and regulations, contractual obligations, best practices and standards that stall also need to comply with (e.g., compliance with laws on copyright, data privacy/protection and computer use/misuse/abuse);
Reference to any other documents that stall needs to be aware of and comply with (e.g., more detailed security policies and procedures as well as any other relevant proceedings not directly related to security). This could be industry-speciﬁc policies such as those businesses that need to deal with environmental issues, aspects of health care, production of pharmaceutical products or food safety.

This management information security policy should be written in a way that the style and content are independent of any particular skill, process, or technical knowledge. For example, the content should be understandable by someone that is not an IT specialist, someone not trained in company ﬁnances or legal affairs, or does not have human resources skills. in other words, it should state information security objectives that are generally understood by all stalls not just people with highly technical backgrounds or certain professional qualiﬁcations or skills.

Advertisements

Approval, Communication, and Awareness

This management policy needs to be approved and signed by the CEO (or someone of similar management authority and accountable status) since the aim is to indicate management commitment and support. The policy needs to be communicated across the organization to all staff and interested parties. This could be in paper form or by electronic means or both. Some organizations display their policies on the walls of ofﬁces, computer rooms, and other areas to ensure they are continually accessible and visible. Other organizations resort to using ICT to distribute and have available their policies and procedures via their internal network. Others may choose to distribute it in paper only for the stall to keep at their own place of work. Whatever the method used, the policy should not be hidden away and forgotten. Stall needs to read, understand, and refresh their memories every so often about its contents and what it says about their speciﬁc information security responsibilities and duties. This policy needs to be reviewed and updated as necessary to take account of the changing nature of the information security risk environment and evolving organizational developments and changes. There needs to be a review process for maintaining this policy, as is the case with all policies and procedures, as part of the ISMS continual improvement process. This management policy is a high-level policy that “sets the scene,” and typically there will more detailed policies, which will give more speciﬁc rules and instructions on the implementation of information security protection. For example, policies on access control cover the rules of access to different organizational resources and facilities such as email servers, databases, network services, applications as well as physical access to buildings, ofﬁces, rooms, and storage equipment.

Advertisements

5.3 Organizational roles, responsibilities and authorities

Top management must ensure that the responsibilities and authorities for roles relevant to information security are assigned and communicated. Top management must assign the responsibility and authority for ensuring that the information security management system conforms to the requirements of this International Standard, and reporting on the performance of the information security management system to top management. Top management may also assign responsibilities and authorities for reporting the performance of the information security management system within the organization.

Advertisements

Roles and Responsibilities

Involvement from top management is critical to the design and effectiveness of any information security program. The definition of “top management” can vary from organization depending on size and structure, but in general, “top management” should involve members of the senior executive team responsible for making strategic decisions within the organization. The intent of involving top management within the information security program is to ensure that enterprise governance is aligned with the information security governance framework. Components of a well-designed information security governance program include leadership, structure, and processes designed to protect an organization’s information security assets. Effective information security governance requires that top management have clear expectations about what to expect from the information security program, how to evaluate the organization’s risk posture, and how to define information security objectives that are in alignment with the strategic direction and goals of the organization. Top Management must allocate responsibility and authority for carrying out information security roles to the appropriate people within the organization. Top Management must communicate all relevant information security management roles, responsibilities, and authorities. Top management’s involvement with the information security program includes ensuring that the intended outcomes of the information security program are achieved, which could include the following:

Alignment with business strategy to meet the organization’s strategic objectives.
A risk management program that identifies and mitigates the impacts to an organization’s resources and assets.
Effective and efficient resource management
Timely and useful metrics reporting
Value-added information security initiatives

Security is ultimately the responsibility of all employees within an organization; however, the most successful information security programs demonstrate effective leadership from top management by setting a “tone at the top” and championing the importance of information security through well-designed policy and direction. The result can be an organization with information security ingrained as part of its culture. The ISO 27001 standard requires that organizations demonstrate leadership and commitment from top management as outlined in Clauses 5 (Leadership) and 9.3 (Management review). The focus within Clause 5 is on the design of the information security management system (ISMS) which requires involvement from top management and includes the establishment of the information security policy and an organizational structure where the responsibilities and roles relevant to information security are defined and communicated. The focus within Clause 9.3 is to establish procedures for top management to be continually involved in the evaluation of the ISMS to ensure its effectiveness. The members of top management that are involved with the leadership of the ISMS should consider the scope of the ISMS. Involvement from top management can vary by organization, but the scope of the ISMS should be considered when determining who from top management will be involved from a leadership and commitment standpoint. Typically, organizations begin by selecting a committee responsible for overseeing the design, operation, maintenance, and improvement of the ISMS. The committee should include members from top management and members from the information security team.
An organization that is able to successfully implement the requirements of Clause 5 will establish an ISMS program with the oversight, support, and direction of top management; an information security policy that includes information security objectives and is appropriate to the organization; and an organizational structure that incorporates information security with upstream channels so that information security performance is effectively reported to top management. In addition to involving top management in the design of the ISMS, they are required to review and evaluate the performance of the ISMS on a continual basis. The frequent involvement of top management during the evaluation phase of the ISMS is a critical requirement. The intent is to provide regular feedback on the performance of the ISMS so that changes in the environment or processes not performing as expected are identified promptly so that corrective action can be successfully implemented. An organization that can successfully implement the requirements of Clause 9.3 will be able to consistently and continually evaluate the operation of the ISMS, with input from top management to ensure the intent and objectives of the ISMS are being achieved and that the improvements are implemented where necessary.

Day-to-day working and operational activities functioning effectively, and the proper management of staff, at all levels throughout the organization, can contribute to an effective information security business environment. In part, this requires a good information security culture within the organization to be in place, with appropriate awareness and understanding of the problems of information security risks and clear lines of responsibility and accountability. It is essential that roles and responsibilities for protecting speciﬁc types of information or information systems or for carrying out speciﬁc information security-related processes are clearly deﬁned and allocated. For example:

The owner of an information system should be given the information security responsibility and accountability for that system (of course, these owners may delegate that day-to-day implementation of security to another individual or to a service provider, but they remain ultimately accountable for the protection of the system and the management of the information security risks);
Personal data manager;
Business owner—a speciﬁc department/group (ensures implementation of policy and procedures, deﬁnes information usage and classiﬁcation for information in their custody, allocates information custodians,deﬁnes access roles and privileges, conducts staff training and awareness and provides protection of personal data under their control);
Chief information security ofﬁcer (CISO);
Information security incident response team;
Business continuity manager;
Internal auditors;
Human resource manager;
IT services manager (IT service management, IT disaster recovery, involvement in incident management);
IT and network administrators/managers (network management, secure network technologies, involvement in incident management);

Authorized users of information systems. In addition, all staff will have general responsibility for information security related to their day-to-day work. For example, reporting of unusual or suspicious behavior either related to their use of IT, network services, or related to other staff or visitors. Also, all individual staff needs to be aware of their responsibility for keeping their passwords and other types of access codes secure, to ensure that they are using organizational resources in accordance with the acceptable usage policy (e.g., rules for using email for sending file attachments).

Advertisements

Resources

As with any successful business venture, it is important to have the right types of resources for the jobs that need to be done. Having stall with the right competence to do a job properly, efficiently, and effectively is key to the overall success of the business. If it is a technical job, then the stall involved need to have the right level of knowledge and skill to handle the technical requirements of the job at hand, to resolve technical problems, and to be able to use techniques, methods, equipment, and procedures relevant to the technical area in question. If it’s a customer service job, then the staff involved must have the relevant skills needed to deal with customers (e.g., they are able to listen and respond effectively to customer’s questions and queries, they are able to satisfactorily resolve customer queries and problems, follow up on feedback from customers and generally be able to meet the expectations of the organization’s customers). Management needs to ensure that for specific information security tasks, it has the right people, with the right skills and knowledge, and experience. This can mean recruiting people who have the right existing skills and experience or recruiting people and providing a training program for them to develop the right skills and experience. In addition, all staff working in the ﬁeld of information security, whether those with experience or those in training, need to keep up to date as the issues and risks in information security continually evolve, as do technology and business practices. Every organization strives to have human resources with certain core competence, and many organizations seek staff with information security skills. The market is expanding, becoming more buoyant, and becoming highly competitive. For many years, organizations have recruited information security personnel with hands-on experience, practical knowledge, and appropriate references. Even though this is still the general basis of recruitment, more and more organizations have started to request applicants have market-proven professional qualiﬁcations, personal certiﬁcations, and in some cases university qualiﬁcations or a combination of both. The current education and training market provides certiﬁed qualiﬁcations, for example, in areas such as:

information security auditing;
information security management;
Risk management;
Information assurance;
Governance
IT security;
Physical security.

Advertisements

Training and Awareness

The organization needs to ensure that staff are aware of information security risks and have a sufﬁcient understanding to support the organization’s information security policy to undertake their normal work functions and tasks. Staff should be trained in the use of information security policies and procedures, security controls applicable to their job function, and the correct use of IT (e.g., log-in procedures, keeping passwords safe, appropriate use of IT). Training should take place during:

Induction training for new staff upon joining the organization. This should cover the company’s information security policies, procedures, and routine practices, whom to contact for help and support regarding information security matters and whom to report security problems to, initial familiarization with the common types of risk malware, hacking, protection of commercially sensitive information and the protection of personal data, fraud, use of email and so on.
On-the-job training providing speciﬁcally tailored instructions on information security suited to the individual’s job function.
Annual (or more frequent) refresher training to keep stalls up to date with new developments and to provide organization-wide reminders or more immediate remedial training as the result of a security incident or an emerging risk.

An organization can deploy a variety of methods to deliver effective information security awareness and training to its staff. The methods that an organization selects will depend on the business culture and its operational needs. Therefore, an information security awareness and training program should be tailored to the speciﬁcs of the organization. You should alternate between different methods, perhaps introducing an element of motivational instruction together with practical interactivity.

Classroom-based training can be highly interactive—such training can vary from half-day/one-day induction/beginners training course, through to various intermediate/advance three-to-ﬁve-day training courses covering a range of speciﬁc topics.
Computer-based/online web-based training and awareness is a good method for reinforcing information security principles and speciﬁc topics. Such training can be delivered as a set of modules, interactive or noninteractive, and be accessible to staff at a time and place convenient to the individual.
Seminars, workshops, round-table discussions, and presentations are especially well suited for introducing the new subject matter and for organizations with multiple sites;
Videos are also an effective way to provide training on various topics.
Posters provide visual reinforcement of information security principles and speciﬁc topics.
On-the-job/desktop training is available.
Internal emails can be used to remind, reinforce and provide updates on organizational policies and procedures.

Advertisements

ISMS-Related Topics

Implementing the requirements of ISO/1EC 27001 covers many different tasks, activities, and processes that need to be carried out, and these are associated with a number of speciﬁc topics that information security professionals, practitioners and other staff will need to have knowledge of and develop experience in, depending on their particular job function. For example, an internal ISMS auditor will require knowledge of the auditing process and methods, whereas an ISMS risk manager would need knowledge and skills of the principles of risk management. These include:

Principles of risk management
Risk assessment;
Risk treatment.
Information security controls:
Generic controls eg, as found in ISO 27002, NIST SP 800 etc;
Sector-speciﬁc controls eg, as found in ISO 27010, 27011,27015, 27017, 27018, 27019.
Performance evaluations:
Measuring and monitoring methods and techniques eg, as found in ISO 27004
ISMS auditing process and methods (eg., as found in 1S0 19011 and 27007).
Certiﬁcation and auditing
Certiﬁcation eg, as found in ISO 27006, ISO 17021;
Auditing (e.g., as found in ISO 27007, ISO 19011).
Legislation and regulations related to information security and privacy
National and regional laws and directives;
Standards covering privacy leg, as found in ISO 29100, 29134, 29190).
Other speciﬁc security-related processes
Incident handling (e.g., as found in ISO 27035, NIST SP 800-61);
Business continuity e.g., as found in ISO 22301, ISO 27031
Operational resilience e.g., as found in B5 16000.
Speciﬁc IT security controls and mechanisms
Network security (e.g., as found in ISO 27033);
Applications security (e.g., as found in ISO 27034);
Malware (eg. as found in NIST SP 800-83);
Firewalls, IDS, IPS;
Access control.

Advertisements

Example of Consolidated Roles and Responsibilities

1) Executive Vice President and Chief Information Officer

The executive vice president and chief information officer (CIO) are responsible for the following:

Acting as the senior information technology (IT) decision-maker and corporate change agent to securely integrate the key components of business transformation: technology, processes, and people.
Providing advice and assistance to senior managers on information security policy and their compliance-based performance.
Promoting the implementation of an information security architecture to mitigate information security-related risk.
Promoting the protection of corporate information resources across postal Service organizations and business partners
Together with the vice president of the functional business area (data steward) and chief privacy officer (CPO), approving the removal of portable electronic devices or media containing sensitive-enhanced or sensitive information from a Postal Service facility. If this responsibility is delegated, notice to that effect must be writing.

2) Chief Postal Inspector

The chief postal inspector is responsible for the following:

Establishing policies, procedures, standards, and requirements for personnel, physical, and environmental security.
Approving the identification of sensitive positions.
Conducting background investigations and granting personnel clearances.
Conducting site security reviews, surveys, and investigations of facilities containing Postal Service computer and telecommunications equipment to evaluate all aspects of physical, environmental, and personnel security.
Providing technical guidance on physical and environmental security activities that support information security, such as controlled areas, access lists, physical access control systems, and identification badges; providing protection of workstations, portable devices, and media containing sensitive-enhanced, sensitive, or critical information.
Providing security consultation and guidance during the system, application, and product development to assure that security concerns are addressed and information and/or evidence that may be needed for an investigation is retained by the information resource.
Assisting the manager, Corporate Information Security Officer (CISO), with reviews, as appropriate.
Investigating reported security incidents and violations.
Conducting revenue/financial investigations including theft, embezzlement, or fraudulent activity.
Providing physical protection and containment assistance and investigating information security incidents as appropriate.
Funding CISO investigative efforts outside of those normally required.
Managing, securing, scanning, and monitoring the Inspection Service’s network and information technology infrastructure.
Defining high-risk international destinations where personnel is prohibited from traveling with their standard-issue Postal Service computers and communications equipment (including laptops, notebook computers, external hard drives, Blackberry devices, USB devices, etc.)
Providing temporary equipment to use when traveling to high-risk international destinations

3) Vice President, Information Technology

The vice president, IT, is responsible for the following:

Sponsoring information security and business continuity management programs and ensuring that financial, personnel, and physical resources are available for completing security and business continuity tasks.
Ensuring confidentiality, availability, and integrity of information processed by IT applications.
Ensuring compliance with the information security certification and accreditation processes.
Together with the vice president of the functional business area, accepting, in writing, residual risks of information resources under their control. The VP IT may delegate this authority to the applicable Business Relationship Management manager. If this authority is delegated, notice to that effect must be in writing.
Reporting to senior management on the status of an incident with a major IT application.
Defining and documenting secure coding best practices.

4) Manager, Computer Operations

The manager of Computer Operations is responsible for the following:

Sponsoring information security and business continuity management programs and ensuring that financial, personnel, and physical resources are available for completing security and business continuity tasks.
Ensuring confidentiality, availability, and integrity of information processed at IT sites.
Ensuring the protection and secure implementation of the Postal Service IT infrastructure.
Supporting information security certification and accreditation processes.
Together with the vice president of the functional business area (data steward) and CPO, approving the removal of portable electronic devices or media containing sensitive-enhanced or sensitive information from an IT facility.
Reporting to senior management on the status of an incident at a major IT facility.
Reviewing and utilizing C&A documentation in the IT Artifacts Library.
Resolving identified vulnerabilities.

5) Manager, Corporate Information Security Office

The manager, CISO, is responsible for the following:

Setting the overall strategic and operational direction of the Postal Service information security program and the program’s implementation strategies.
Engaging at any point on any level for issues related to information security that impact the Postal Service.
Recommending members to the Information Security Executive Council.
Developing and disseminating information security policies, processes, standards, and procedures.
Managing the certification and accreditation (C&A) process.
Providing guidance on application security, reviewing the C&A documentation package, and accrediting sensitive-enhanced, sensitive, and critical information resources developed for, endorsed by, or operated on behalf of the Postal Service.
Managing the Network Connectivity Review Board (NCRB) process.
Authorizing temporary access to information resource services.
Conducting site security reviews or providing support to the Postal Inspection Service during its site security reviews, as requested.
Providing consulting support for securing the network perimeter, infrastructure, integrity controls, asset inventory, identification, authentication, authorization, intrusion detection, penetration testing, and audit logs and for information security architecture, technologies, procedures, and controls.
Approving encryption technologies.
Providing leadership of the security initiatives for the Enterprise Architecture Forum.
Developing and implementing a comprehensive information security training and awareness program that is mandatory for all employees at the time of hire and annually thereafter.
Serving as the central point of contact for all information security issues and providing overall consultation and advice on information security policies, processes, standards, procedures, requirements,controls, services, and issues.
At least semi-annually, assessing the adequacy of information security policy and process to reflect changes to business objectives and the operating environment (including technology infrastructure, threats, vulnerabilities, and risks).
At least annually, assessing the adequacy of information security controls and recommending changes as necessary.
Establishing evaluation criteria and recommending security hardware, software, and audit tools.
Approving the establishment of shared accounts
Ensuring compliance with information security policies and standards through inspections, reviews, and evaluations.
Providing support to the Office of the Inspector General (OIG) and the Inspection Service during the conduct of investigative activities concerning information security, the computing infrastructure, and network intrusions, as requested.
Providing support to the chief postal inspector during the conduct of facility/site security reviews, as requested.
Escalating security issues to executive management and promulgating security issues and recommended corrective actions across the Postal Service.
Authorizing monitoring and surveillance activities of information resources.
Authorizing (in case of threats to the Postal Service infrastructure, network, or operations) appropriate actions that may include viewing and/or disclosing data to protect Postal Service resources or the nation’s communications infrastructure.
Confiscating and removing any information resource suspected of inappropriate use or violation of Postal Service information security policies to preserve evidence that might be used in forensic analysis of a security incident.
Reviewing and approving information security policy for mail processing equipment/mail-handling equipment (MPE /MHE).

6) Information Security Executive Council

The Information Security Executive Council consists of appropriate Postal Service representatives and serves as a steering committee advising the CISO and promulgating information security throughout the Postal Service.

7) Vice Presidents, Functional Business Areas

The vice presidents of Postal Service functional business areas are responsible for the following:

Ensuring resources are available for completing information security tasks.
Ensuring the security of all information resources within their organization.
Together with the VP IT, accepting, in writing, residual risks of information resources under their control. The vice presidents of functional business areas may delegate this authority to the applicable executive sponsor. If this authority is delegated, notice to that effect must be in writing.
Ensuring that contractual agreements require all suppliers, contractors, vendors, and business partners to adhere to Postal Service information security policies.
Together with the CIO and CPO, approving the removal of portable electronic devices or media containing sensitive-enhanced or sensitive information from a Postal Service facility. (If this responsibility is delegated, the delegation of responsibility must be writing.)

8) Vice President, Engineering

The vice president, Engineering, is responsible for ensuring the security of information resources used in support of the MPE/MHE environment, including technology acquisition, development, and maintenance.

9) Vice President, Network Operations

The vice president, Network Operations, is responsible for the security of the mail and information resources used in support of MPE/MHE strategies and logistics.

10) Officers and Managers

All officers, business and line managers, and supervisors, regardless of functional area, are responsible for the following:

Implementing information security policies, ensuring compliance with information security policies by organizations and information resources under their direction, and invoking user sanctions as required.
Identifying sensitive information positions in their organizations and ensuring that personnel occupying sensitive positions hold the appropriate level of clearance.
Managing access authorizations and documenting information security responsibilities for all personnel under their supervision.
Ensuring all personnel under their supervision receive information security training commensurate with their responsibilities upon hire and annually thereafter, and maintaining auditable training records when there isn’t an automated system.
Ensuring all personnel under their supervision comply with Postal Service information security policies and procedures.
Including employee information security performance in performance evaluations.
Supervising information security responsibilities of their onsite contractor personnel.
Processing departing personnel appropriately and notifying the appropriate system and database administrators when personnel no longer require access to information resources.
Initiating a written request for message data content or Internet usage monitoring and sending it to the CPO for approval.
Approving or denying requests, by personnel under their supervision, for access to information resources beyond temporary information resource services and reviewing those access authorizations on a semiannual basis.
Ensuring that all hardware and software are obtained in accordance with official Postal Service processes.
Protecting information resources and ensuring their availability through business continuity activities including plans, procedures, off-site backups, periodic testing, workarounds, and training/cross-training essential and alternate personnel.
Ensuring that personnel under their supervision who remove a portable electronic device or media from a Postal Service facility are aware of their responsibility for its security and have a place to secure the device or media when it is not being used. Ensuring compliance with Postal Service information security policy and procedures.
Reporting suspected information security incidents to the Computer Incident Response Team (CIRT) immediately, protecting information resources at risk during security incidents, containing the incident, and following continuity plans for disruptive incidents

11) Executive Sponsors

Executive sponsors, as representatives of the vice president of the functional business area, are the business managers with oversight (e.g., funding, development, production, and maintenance) of the information resource and are responsible for the following:

Consulting with the CPO for determining information sensitivity and Privacy Act applicability.
Ensuring a business impact assessment (BIA) is conducted to determine the sensitivity and criticality of each information resource under his or her control and to determine the potential consequences of information resource unavailability.
Providing resources to ensure that security requirements are properly addressed and information resources are properly protected.
Ensuring completion of a site security review, if the facility hosts an information resource designated as sensitive-enhanced, sensitive, or critical.
Ensuring that contract personnel under their supervision comply with Postal Service information security policies and procedures.
Ensuring that all information security requirements are included in contracts and strategic alliances.
Ensuring compliance with and implementation of the Postal Service privacy policy; data collection, retention, and destruction policies; customer or employee privacy notices; and software licensing.
Appointing, in writing, an information systems security representative (ISSR).
Ensuring completion of security-related activities throughout the Information resource C&A life cycle.
Ensuring that information resources within their purview are capable of enforcing appropriate levels of information security services to ensure data integrity.
Preventing residual data from being exposed to unauthorized users as information resources are released or reallocated.
Authorizing access to the information resources under their control and reviewing those access authorizations on a semiannual basis.
Maintaining an accurate inventory of Postal Service information resources and coordinating hardware and software upgrades.
Ensuring appropriate funding for proposed business partner connectivity, including costs associated with the continued support for the life of the connection.
Initiating and complying with the network connectivity request requirements and process as documented in the Information Security Network Connectivity Process.
Notifying the NCRB when the business partner trading agreement ends or when network connectivity is no longer required.
On a semiannual basis, reviewing and validating business partner connectivity to the Postal Service intranet.
Funding application recovery (including but not limited to hardware/ software licenses required, continuity plan development, testing, and maintenance) for applications.
If the VP functional business area delegated this authority to the executive sponsor, the executive sponsor will work jointly with the VP IT (or the Business Relationship Management manager if this authority is delegated) to review the C&A documentation package, accept the residual risk to an application, and approve the application for production or return the application to the applicable life cycle phase for rework.
Reporting suspected information security incidents to the CIRT immediately, protecting information resources at risk during the security incident, containing the incident, and following continuity plans for disruptive incidents.
Coordinating the resolution of identified vulnerabilities with the appropriate IT organization (e.g., Computer Operations, Business Relationship Management, Solutions Development and Support, etc.).

12) Functional System Coordinators

The functional system coordinator (FSC) role is an ad hoc activity assigned by a data steward and is not a position or job function. An FSC has expert knowledge of the information resource and is familiar with the people and levels of access being requested. The FSC role may be required for all information resources registered in eAccess. The FSC role is restricted to Postal Service employees. An FSC is responsible for approving or denying a request based on the role or access level requested. If access to sensitive information is requested, the requestor must have a sensitive clearance. The FSC has the last level of approval before a request is sent to the log-on administrator to create the account, which will then become active.

13) Business Relationship Management Portfolio Managers

Business Relationship Management portfolio managers are responsible for the following:

Supporting the executive sponsor in the development of information resources and the C&A process, including the BIA, risk assessment, and business continuity plans.
If an ISSR has not been assigned by the executive sponsor, appointing an ISSR to perform security-related activities.
Providing coordination and support to executive sponsors and disaster recovery (DR) service providers for all matters relating to business continuity planning.
Reviewing the C&A documentation package and completing a risk mitigation plan for risks identified as high or medium. If a documented high or medium vulnerability will not be mitigated, preparing and signing a Risk Acceptance Letter as part of the C&A process.
Business Relationship Management portfolio managers are responsible for the following: If the VP IT delegated this authority to the Business Relationship Management portfolio manager, the Business Relationship Management portfolio managers will work jointly with the vice president of the functional business area (or the executive sponsor, if this authority is delegated) to review the C&A documentation package, accept the residual risk to an information resource, and approve the information resource for production or return the information resource to the applicable life-cycle phase for rework.
Notifying the NCRB when the business partner trading agreement ends or when network connectivity is no longer required.
Ensuring that the information resource is registered in eAccess.
Accepting personal accountability for adverse consequences if the information resource was placed in production before the C&A process was completed.
Completing along with their staff the annual C&A training.
On a semiannual basis, reviewing and validating business partner connectivity to the Postal Service intranet.
Resolving identified vulnerabilities.
Managing projects through their project managers who are responsible for the following:

Developing and maintaining C&A documentation as required.
Incorporating the appropriate security controls in all information resources. Ensuring that the information resource is entered in the Enterprise Information Repository (EIR) and updated as required.
Filing C&A documentation in the IT Artifacts Library and maintaining the hard copies and electronic copies for the appropriate retention periods

14) Managers of Information Technology Solution Centers

The managers of Information Technology Solution Centers are responsible for the following:

Sponsoring information security and business continuity management programs and ensuring that financial, personnel, and physical resources are available for completing security and business continuity tasks.
Ensuring confidentiality, availability, and integrity of data.
Ensuring the protection and secure implementation of the Postal Service IT infrastructure.
Ensuring compliance with the information security C&A processes.
Together with the vice president of the functional business area, accepting, in writing, the residual risk of applications and approving deployment.
Together with the vice president of the functional business area, approving the removal of portable electronic devices or media containing sensitive-enhanced or sensitive information from a Postal Service facility. (If this responsibility is delegated, notice to that effect must be writing.)
Managing projects through their project managers who are responsible for the following:

Incorporating the appropriate security controls in all information resources.
Notifying the NCRB when the business partner trading agreement ends or when network connectivity is no longer required.
On a semiannual basis, reviewing and validating business partner connectivity to the Postal Service intranet.
Functioning as the incident management team leader for their facility.
Identifying and training key technical personnel to provide support in business continuity planning for their facility, information resources housed in their facility, and the alternate DR facilities.
Resolving identified vulnerabilities.

15) Installation Heads

Installation heads are in charge of Postal Service facilities or organizations, such as areas, districts, Post Offices, mail processing facilities, parts depots, vehicle maintenance facilities, computer service centres, or other installations. Installation heads are responsible for the following:

Designating a security control officer (SCO) who is responsible for personnel and physical security at that facility, including the physical protection of computer systems, equipment, and information located therein.
Implementing physical and environmental security support for information security, such as the protection of workstations, portable devices, and media containing sensitive-enhanced, sensitive, or critical information.
Controlling physical access to the facility, including the establishment and implementation of controlled areas, access lists, physical access control systems, and identification badges.
Funding building security equipment and security-related building modifications.
Maintaining an accurate inventory of Postal Service information resources at their facilities and implementing appropriate hardware security and configuration management.
Maintaining and upgrading all security investigative equipment, as necessary.
Ensuring completion of a site security review, providing assistance to the Inspection Service and CISO as required, and accepting site residual risk.
Ensuring that the Postal Service security policy, standards, and procedures are followed in all activities related to information resources (including procurement, development, and operation) at their facility.
Ensuring that all employees who use or are associated with the information resources in the facility are provided information security training commensurate with their responsibilities and take appropriate action in response to employees who violate established security policy or procedures.
Cooperating with the Inspection Service to ensure the physical protection of the network infrastructure located at the facility.
Reporting information security incidents to the CIRT immediately, containing the incident, following continuity plans for disruptive incidents, and assessing damage caused by the incident.
Resolving identified vulnerabilities.
Developing, maintaining, and testing:

Workgroup Recovery Plan required for each business function.
Emergency Action Plans required for each facility to ensure personnel are safely evacuated and provides for the protection of the employees.
Incident Management Facility Recovery Plan required for each major IT site.
Disaster Recovery Plan (DRP) (business information systems disaster) documents required for each critical system that supports essential (core) business functions.

14. Implementing and managing the following plans and team members:

Emergency Action Plan.
Incident Management Facility Recovery Plan.
Workgroup Recovery and “Beyond” Continuity of Operations(COOP) Plans.
DRP (business information systems disaster) documents.

16) Chief Privacy Officer

The CPO is responsible for the following:

Developing policy for defining information sensitivity and determining information sensitivity designations.
Providing guidance on privacy issues to ensure Postal Service compliance with the Privacy Act, the Freedom of Information Act, Gramm-Leach-Bliley Act, and Children’s Online Privacy Protection Act.
Developing privacy compliance standards, customer or employee privacy notices, and customer data collection standards, including cookies and Web-transfer notifications.
Developing appropriate data record retention, disposal, and release procedures and standards.
Approving requests for message data content or Internet usage monitoring.
Consulting on and reviewing the BIA and approving the determination of information sensitivity.
Providing guidance throughout the investigation of a mass data compromise relating to the privacy of customer and employee/contractor personal information.
Developing communications to transmit to impacted parties to amass data compromise.

17) Inspector General

The inspector general is responsible for the following:

Conducting independent financial audits and evaluation of the operation of the Postal Service to ensure that its assets and resources are fully protected.
Preventing, detecting, and reporting fraud, waste, and program abuse.
Investigating computer intrusions and attacks against Postal Service information resources per agreement with the Inspection Service.
Investigating the release or attempted release of malicious code onto Postal Service information resources.
Investigating the use of Postal Service information resources to attack external networks.
Promoting efficiency in the operation of the Postal Service.
Funding CISO investigative efforts outside of those normally required.
The manager, Technical Crimes Unit (TCU), is responsible for the following:

Functioning as an ongoing liaison with the CIRT.
Serving as a point of contact between the CIRT and law enforcement agencies.
Conducting criminal investigations of attacks upon Postal Service networks and computers.

18) Manager, Business Continuance Management

The manager, Business Continuance Management, is responsible for the following:

Protecting the health and safety of Postal Service employees.
Ensuring the continuity of business, expediting recovery from a loss of a single critical system or a major disruption to business functions.
Reviewing and assessing Business Continuity Management (BCM) program plans.
Defining, planning, developing, implementing, managing, assuring the testing and exercising, and monitoring for compliance of a sustainable BCM program for the Postal Service.
Ensuring appropriate Business Continuity Plans (BCPs) are developed, tested, and exercised for business functions and information technology services.
Ensuring appropriate DRP documents are developed and business information systems are tested for all critical and business functions and services.
Certifying all DRP test and BCP exercise.
Developing and implementing lines of communication to the IT organization about BCM matters.
Promoting BCM awareness and providing training for Postal Service personnel.
Ensuring compliance with BCM and information security policies.
Establishing a BCM policy and strategy.

19) Manager, Telecommunications Services

The manager, Telecommunications Services (TS), is responsible for the following:

Implementing and maintaining operational information security throughout the network infrastructure including timely security patch management. Critical security patches for PCI-related information resources must be installed within 30 days of release.
Recommending and deploying network hardware and software based on the Postal Service security architecture.
Operational monitoring and tracking of all physical connections between any component of the Postal Service telecommunications infrastructure and any associated information resource not under Postal Service control.
Implementing security controls and processes to safeguard the availability and integrity of the Postal Service intranet including physical access to network infrastructure and the confidentiality of sensitive enhanced and sensitive information.
Implementing the network perimeter firewalls, demilitarized zones, secure enclaves, and proxy servers.
Designating TS representative to the NCRB.
Ensuring secure and appropriate connectivity to the Postal Service intranet.
Ensuring network services and protocols used by Postal Service information resources provide the appropriate level of security for the Postal Service intranet and the information transmitted.
Implementing secure methods of remote access and appropriate remote access controls.
Implementing two-factor authentication and the associated infrastructure for network management.
Implementing only Postal Service-approved encryption technology.
Implementing appropriate network security administration and managing accounts appropriately.
Maintaining the integrity of data and network information resources.
Supporting the implementation of approved security incident detection and prevention technologies (e.g., virus scanning, intrusion detection systems, and intrusion prevention systems) throughout the perimeter.
Maintaining an accurate inventory of Postal Service network information resources.
Monitoring network security alerts and logs and providing network security audit logs to the CISO ISS.
Ensuring that recovery plans and sufficient capacity are in place for the recovery of the telecommunications infrastructure for the IT-supported Postal Service sites.
Identifying and training key technical personnel to provide support in BCM for information resources housed in IT-supported Postal Service sites.
Monitoring network traffic for anomalies, conducting perimeter scanning for viruses, malicious code, and usage of nonstandard network protocols, and immediately reporting suspected information security incidents to the CIRT.
Protecting information resources at risk during security incidents (if feasible) and providing support for CIRT incident containment and response.
Approving all wireless technology before any implementation activities are initiated.
Implementing and managing wireless local area network connectivity.
Detecting unauthorized access points.
Resolving identified vulnerabilities.

20) Managers Responsible for Computing Operations

The managers responsible for computing operations are responsible for the following:

Implementing information security policies, procedures, and standards and ensuring compliance.
Coordinating and implementing standard platform configurations based on the Postal Service security architecture.
Creating and maintaining a timely patch management process and deploying patches to resources under their control. Critical security patches for PCI-related information resources must be installed within 30 days of release.
Maintaining an accurate inventory of Postal Service information resources, tracking and reacting to security vulnerability alerts, coordinating hardware and software upgrades, and maintaining appropriate records.
Deploying and maintaining anti-virus software and recognition patterns to scan for malicious code and usage of nonstandard network protocols.
Supporting the C&A process for internally managed information resources.
Ensuring that remote access is appropriately managed.
Implementing appropriate security administration and ensuring that accounts are managed appropriately.
Maintaining the integrity of data and information resources and ensuring the appropriate level of information resource availability.
Ensuring the installation of the authorized internal warning banner
Disseminating security awareness and warning advisories to local users.
Reporting suspected information security incidents to the CIRT immediately, protecting information resources at risk during security incidents, implementing containment, and assisting in restoring information resources following an attack.
Resolving identified vulnerabilities.

21) Manager, Corporate Information Security Office, Information Systems Security

The manager, CISO ISS is responsible for the following:

Determining the requirements and standards for secure enclaves.
Assessing information resources to determine the need for placement in a secure enclave.
Recommending and approving standard configurations and hardening standards for Postal Service information resources.
Approving two-factor authentication (e.g., digital certificates, digital signatures, biometrics, smart cards, and tokens) and the associated infrastructure for network management.
Approving and managing intrusion detection systems and intrusion prevention systems.
Approving, managing, and ensuring appropriate perimeter penetration testing and network vulnerability scans and testing.
Providing support to the OIG during the conduct of investigative activities concerning information security, the computing infrastructures, and network intrusion as requested.
Approving the use of networking monitoring tools, except those used by the OIG.
Providing support to the chief postal inspector during his or her conduct of site security reviews as requested.
Conducting monitoring and surveillance activities.
Collecting, correlating, and reviewing all Postal Service security audit log files and security alerts.
Reviewing information security policy and processes for MPE/MHE.
Developing and maintaining an information security architecture and coordinating a secure Postal Service computing infrastructure by setting standards and developing the security processes and procedures.
Removing network connectivity from any computing device that does not meet the defined operating system and anti-virus software and recognition pattern thresholds.
Managing the NCRB to control connectivity to the Postal Service computing infrastructure.
Designating the chairperson of the NCRB and additional ISS representatives to the NCRB, as required.
Ordering the disabling of an information resource or network connection that does not comply with Postal Service policies, procedures, and standards or which is found to pose a significantly greater risk than when originally assessed.
Managing the CIRT to help the Postal Service contain, eradicate, document, and recover following a computer security incident and return to a normal operating state.

19. The NCRB is responsible for the following:

Managing the Postal Service network connectivity process through the implementation of the Information Security Network Connectivity Process.
Developing system connectivity requirements for Postal Service connections to external systems, externally facing information resources (e.g., FTP servers), and connections via the Internet to Postal Service development, production, and internal networks.
Developing standard connectivity and documentation criteria to expedite approval of connectivity requests without additional board action.
Requesting additional information, security reviews, or audits about proposed or approved connections, if deemed necessary.
Evaluating connectivity and firewall change requests and approving or rejecting them based upon existing policy, best practices, and the level of risk associated with the request.
Consulting with executive sponsors on network information security requirements.
Assisting the requester in identifying alternative solutions for denied requests that are acceptable to the requester and the Postal Service.
Reviewing new information resource, infrastructure, and network connections and their effects on overall Postal Service operations and information security.
Recommending and approving network services and protocols.
Recommending changes to the business partner network. In situations where high-risk factors exist, issuing mitigating requirements for connectivity.

20. The CIRT is responsible for the following:

Providing an immediate and effective response to computer security incidents as they occur.
Working with an organization to contain, eradicate, document, and recover following a computer security incident.
Engaging other Postal Service organizations including, but not limited to, the OIG and Inspection Service.
Escalating information security issues to executive management as required.
Conducting a post-incident analysis, where appropriate, and recommending preventive actions.
Maintaining a repository for documenting, analyzing, and tracking Postal Service security incidents until they are closed.
Interfacing with other governmental agencies and private-sector computer incident response centers.
Participating in and providing lesson learned information from information security incidents into ongoing information security awareness and training programs.
Developing and documenting processes for incident reporting and management.
Providing support to the OIG and the Inspection Service, as requested.
Designating an information security policy and process program manager who is responsible for establishing, documenting, and disseminating information security policies, standards, and processes.

22) Managers, Help Desks

The managers, Help Desks, are responsible for the following:

Creating the entry for the problem tracking management system for security incidents reported to the Help Desks.
Providing technical assistance for responding to suspected virus incidents reported to the Help Desks.
Escalating unresolved suspected virus events to the CIRT.

23) Contracting Officers and Contracting Officer Representatives

Contracting officers and contracting officer representatives are responsible for the following:

Ensuring that information technology suppliers, contractors, vendors, and business partners are contractually obligated to abide by Postal Service information security policies, standards, and procedures.
Thoroughly vetting service providers for PCI services prior to engagement that includes a risk analysis and documentation to reflect due diligence to the PCI assessor.
Updating the PCI Program Management Office (PMO) with status information on service providers for the PCI environment.
Verifying that information technology suppliers, vendors, and business partners responsible for storing, processing, or transmitting Postal Service payment card information complete an annual Letter of Attestation providing an acknowledgement of their responsibility for the security of payment card data, under the current PCI DSS.
Monitoring service provider PCI compliance at least annually.
Verifying that all contracts and business agreements requiring access to Postal Service information resources identify sensitive positions, specify the clearance levels required for the work, and address appropriate security requirements.
Verifying that contracts and business agreements allow monitoring and auditing of any information resource project.
Verifying that the security provisions of the contract and business agreements are met.
Confirming the employment status and clearance of all contractors who request access to information resources.
Verifying all account references, building access, and other privileges are removed for contractor personnel when they are transferred or terminated.
11. Notifying the CIRT of any security breaches reported to them by the service providers.

24) General Counsel

The general counsel is responsible for the following:

Ensuring that information technology contractors, vendors, and business partners are contractually obligated to abide by Postal Service information security policies, standards, and procedures.
Ensuring that contracts and agreements allow monitoring and auditing of Postal Service information resource projects.

25) Business Partners

Business partners may request connectivity to Postal Service network facilities for legitimate business needs. Business partners requesting or using connectivity to Postal Service network facilities are responsible for the following:

Initiating a request for connectivity to the Postal Service executive who sponsors the request.
Complying with Postal Service network connectivity request requirements and process.
Abiding by Postal Service information security policies regardless of where the systems are located or who operates them. This also includes strategic alliances.
Protecting information resources at risk during security incidents, if feasible.
Reporting information security incidents immediately to the CIRT, the executive sponsor, and the information systems security officer (ISSO) assigned to their project.
Taking action, as directed by the CIRT, to eradicate the incident, recover from it, and document actions regarding the security incident.
Allowing site security reviews by the Postal Inspection Service and CISO.
Allowing audits by the OIG.

26) Accreditor

The manager, CISO, functions as the accreditor and is responsible for the following:

Reviewing the risk mitigation plan and supporting C&A documentation package together with business requirements and relevant Postal Service issues.
Escalating security concerns or preparing and signing an accreditation letter that makes one of the following recommendations: accepting the information resource with its existing information security controls, requiring additional security controls with a timeline to implement, or deferring deployment until information security requirements can be met.
Forwarding the accreditation letter and C&A documentation package to the Business Relationship Management manager and executive sponsor.

27) Certifier

The manager, Security Certification and Accreditation Process, who is appointed by the manager, CISO, functions as the certifier and is responsible for the following:

Managing and providing guidance to the ISSOs.
Reviewing the C&A evaluation report and the supporting C&A documentation package.
Escalating security concerns or preparing and signing a certification letter.
Forwarding the certification letter and C&A documentation package to the accreditor.
Maintaining an inventory of all information resources that have completed the C&A process.

28) Security Control Officers

SCOs ensure the general security of the facilities to which they are appointed, including the safety of on-duty personnel and the security of mail, Postal Service funds, property, and records entrusted to them . SCOs are responsible for the following:

Establishing and maintaining overall physical and environmental security at the facility, with technical guidance from the Inspection Service.
Establishing controlled areas within the facility, where required, to protect information resources designated as sensitive-enhanced, sensitive, or critical.
Establishing and maintaining access control lists of people who are authorized access to specific controlled areas within the facility.
Ensuring positive identification and control of all personnel and visitors in the facility.
Ensuring the protection of servers, workstations, portable devices, and information located at the facility.
Consulting on the facility COOP plans.
Conducting annual facility security reviews using the site security survey provided by the Inspection Service.
Reporting suspected information security incidents to the CIRT and providing support for incident containment and response, as requested.
Responding to physical security incidents and reporting physical security incidents to the Inspection Service.
Interfacing with CIRT, Inspection Service, CISO, or OIG, as required.

29) Information Systems Security Representatives

ISSRs are appointed in writing by the executive sponsors or the Business Relationship Management portfolio manager and are members of the information resource development or integration teams. The role of the ISSR can be performed in conjunction with other assigned duties. If an ISSR is not assigned, the project manager assumes the role. ISSRs are responsible for the following:

Providing support to the executive sponsor and Business Relationship Management portfolio manager, as required.
Promoting information security awareness on the project team.
Ensuring security controls and processes are implemented.
Notifying the executive sponsor, Business Relationship Management portfolio manager, and ISSO of any additional security risks or concerns that emerge during development or acquisition of the information resource.
Developing or reviewing security-related documents required by the C&A process as assigned by the executive sponsor or Business Relationship Management portfolio manager.
Working with the ISSO to complete the eC&A artifacts in the eC&A system and sending other required artifacts (e.g., TAD, operational training, etc.) or their location (i.e., URL) to the ISSO.

30) Information Systems Security Officers

ISSOs are responsible for the following:

Chairing the C&A team.
Ensuring that a BIA is completed for each information resource.
Ensuring that the responsible project manager records the sensitivity and criticality designations in EIR.
Providing guidance on how information resources are vulnerable to threats, what controls and countermeasures are appropriate, and the C&A process.
Conducting site security reviews or helping the Inspection Service conduct them.
Reviewing the C&A documentation package.
Preparing and signing the C&A evaluation report and forwarding the evaluation report and C&A documentation to the certifier.
Advising and consulting with executive sponsors, Business Relationship Management portfolio managers, and ISSRs during the BIA process so they know the background for

baseline security requirements that apply to all information resources and
Recommending security requirements to executive sponsors and Business Relationship Management portfolio managers during the BIA process, based on generally accepted industry practices and the risks associated with the information resource.

31) System and Network Administrators

System and network administrators are technical personnel who serve as computer systems, network, server, and firewall administrators, whether the system management function is centralized, distributed, subcontracted, or outsourced. System and network administrators are responsible for the following:

Implementing information security policies and procedures for all information resources under their control, and also for monitoring the implementation for proper functioning of security mechanisms.
Implementing appropriate platform security based on the platform specific hardening standards for the information resources under their control.
Complying with standard configuration settings, services, protocols, and change control procedures.
Applying approved patches and modifications in accordance with policies and procedures established by the Postal Service. Ensuring that security patches and bug fixes are kept current for resources under their control.
Implementing appropriate security administration and ensuring that log-on IDs are unique.
Setting up and managing accounts for information resources under their control in accordance with policies and procedures established by the Postal Service.
Disabling accounts of personnel whose employment has been terminated, who have been transferred, or whose accounts have been inactive for an extended period of time.
Making the final disposition (e.g., deletion) of the accounts and the information stored under those accounts.
Managing sessions and authentication and implementing account time-outs.
Preventing residual data from being exposed to unauthorized users as information resources are released or reallocated.
Testing information resources to ensure security mechanisms are functioning properly.
Tracking hardware and software vulnerabilities.
Maintaining an accurate inventory of Postal Service information resources under their control.
Ensuring that audit and operational logs, as appropriate for the specific platform, are implemented, monitored, protected from unauthorized disclosure or modification, and are retained for the time period specified by Postal Service security policy.
Reviewing audit and operational logs and maintaining records of the reviews.
Identifying anomalies and possible internal and external attacks on Postal Service information resources.
Reporting information security incidents and anomalies to their manager and the CIRT immediately upon detecting or receiving notice of a security incident.
Protecting information resources at risk during security incidents, assisting in the containment of security incidents as required, and taking action as directed by the CIRT.
Participating in follow-up calls with the CIRT and fixing issues identified following an incident.
Ensuring that virus protection software and signature files are updated and kept current for resources under their control.
Ensuring the availability of information resources by implementing backup and recovery procedures.
Ensuring compliance with Postal Service information security policy and procedures.
Monitoring the implementation of network security mechanisms to ensure that they are functioning properly and are in compliance with established security policies.
Maintaining a record of all monitoring activities for information resources under their control.
Assisting with periodic reviews, audits, troubleshooting, and investigations, as requested.
Resolving identified vulnerabilities.

32) Database Administrators

Database administrators (DBAs) are responsible for the following:

Implementing appropriate database security based on the platform-specific hardening standards for the information resources under their control.
Implementing information security policies and procedures for all database platforms and monitoring the implementation of database security mechanisms to ensure that they are functioning properly and are in compliance with established policies.
Applying approved patches and modifications, in accordance with policies and procedures established by the Postal Service.
Maintaining an accurate inventory of Postal Service information resources under their control.
Implementing appropriate database security administration and ensuring that log-on IDs are unique.
Setting up and managing accounts for systems under their control in accordance with policies and procedures established by the Postal Service.
Disabling accounts of personnel that has been terminated, transferred, or have accounts that have been inactive for an extended period of time.
Making the final disposition (e.g., deletion) of the accounts and the information stored under those accounts.
Managing sessions and authentication and implementing account time-outs.
Preventing residual data from exposure to unauthorized users as information resources are released or reallocated.
Testing database software to ensure that security mechanisms are functioning properly.
Tracking database software vulnerabilities, and deploying database security patches.
Ensuring database logs are turned on, logging appropriate information, protected from unauthorized disclosure or modification, and retained for the time period specified.
Reviewing database audit logs and maintaining records of log reviews.
Assisting with periodic reviews, audits, troubleshooting, and investigations, as requested.
Ensuring the availability of databases by implementing database backup and recovery procedures.
Identifying anomalies and possible attacks on Postal Service information resources.
Reporting information security incidents and anomalies to their manager and the CIRT immediately upon detecting or receiving notice of a security incident.
Protecting information resources at risk during security incidents, assisting in the containment of security incidents as required, and taking action as directed by the CIRT.
Resolving identified vulnerabilities.

33) All Personnel

All personnel, including employees, suppliers, consultants, contractors, business partners, customers who access non publicly available Postal Service information resources (e.g., mainframes or the internal Postal Service network), and other authorized users of Postal Service information resources are responsible for the following:

Complying with applicable laws, regulations, and Postal Service information security policies, standards, and procedures.
Displaying proper identification while in any facility that provides access to Postal Service information resources.
Being aware of their physical surroundings, including weaknesses in physical security and the presence of any authorized or unauthorized visitor.
Protecting information resources, including workstations, portable devices, information, and media.
Always using their physical and technology electromechanical access control identification badge or device to gain entrance to a controlled area.
Ensuring no one tailgates into a controlled area on their badge.
Performing the security functions and duties associated with their job, including the safeguarding of their log-on IDs and passwords.
Changing their password immediately, if they suspect that the password has been compromised.
Prohibiting any use of their accounts, log-on IDs, passwords, personal information numbers (PINs), and tokens by another individual.
Taking immediate action to protect the information resources at risk upon discovering a security deficiency or violation.
Only using licensed and approved hardware and software.
Protecting intellectual property.
Complying with Postal Service remote access information security policies, including those for virtual private networks, modem access, dial-in access, secure telecommuting, and remote management and maintenance.
Complying with acceptable use policies.
Maintaining an accurate inventory of information resources for which they are responsible.
Protecting information resources against viruses and malicious code.
Calling the appropriate Help Desk for technical assistance in response to suspected virus incidents.
Immediately reporting to the CIRT via telephone or email and, as appropriate, to their immediate supervisor, manager, or system administrator, any suspected security incidents, including security violations or suspicious actions, suspicion or occurrence of any fraudulent activity; unauthorized disclosure, modification, misuse, or inappropriate disposal of Postal Service information; and potentially dangerous activities or conditions.
Taking action, as directed by the CIRT, to protect against information security incidents, to contain and eradicate them when they occur, and to recover from them.
Documenting all conversations and actions regarding the security incident and completing PS Form 1360, Information Security Incident Report, or an acceptable facsimile. If an individual removes a portable electronic device from a Postal Service facility, he or she must do the following:

If the device contains sensitive-enhanced or sensitive information, request approval in writing from his or her functional area vice president (data steward), CPO, and the VP IT Operations or their designees.
Reporting any missing or stolen device or media immediately to his or her manager, the CIRT via e-mail to xxxt@xxx.xxx.gov, and to the local Inspection Service office. If the device has been stolen somewhere other than Postal Service premises, report the theft to the local police as well.

———————————End of example—————————

Advertisements

Back to Home Page

If you need assistance or have any doubt and need to ask any questions contact me at preteshbiswas@gmail.com. You can also contribute to this discussion and I shall be happy to publish them. Your comments and suggestion are also welcome.

Published by Pretesh Biswas

Pretesh Biswas has wealth of qualifications and experience in providing results-oriented solutions for your system development, training or auditing needs. He has helped dozens of organizations in implementing effective management systems to a number of standards. He provide a unique blend of specialized knowledge, experience, tools and interactive skills to help you develop systems that not only get certified, but also contribute to the bottom line. He has taught literally hundreds of students over the past 5 years. He has experience in training at hundreds of organizations in several industry sectors. His training is unique in that which can be customized as to your management system and activities and deliver them at your facility. This greatly accelerates the learning curve and application of the knowledge acquired. He is now ex-Certification body lead auditor now working as consultancy auditor. He has performed hundreds of audits in several industry sectors. As consultancy auditor, he not just report findings, but provide value-added service in recommending appropriate solutions. Experience Consultancy: He has helped over 100 clients in a wide variety of industries achieve ISO 9001,14001,27001,20000, OHSAS 18001 and TS 16949 certification. Industries include automotive, metal stamping and screw machine, fabrication, machining, assembly, Forging electrostatic and chrome plating, heat-treating, coatings, glass, plastic and rubber products, electrical and electronic equipment, assemblies & components, batteries, computer hardware and software, printing, placement and Security help, warehousing and distribution, repair facilities, consumer credit counseling agencies, banks, call centers, etc. Training: He has delivered public and on-site quality management training to over 1000 students. Courses include ISO/TS -RAB approved Lead Auditor, Internal Auditing, Implementation, Documentation, as well as customized ISO/TS courses, PPAP, FMEA, APQP and Control Plans. Auditing: He has conducted over 100 third party registration and surveillance audits and dozens of gap, internal and pre-assessment audits to ISO/QS/TS Standards, in the manufacturing and service sectors. Other services: He has provided business planning, restructuring, asset management, systems and process streamlining services to a variety of manufacturing and service clients such as printing, plastics, automotive, transportation and custom brokerage, warehousing and distribution, electrical and electronics, trading, equipment leasing, etc. Education & professional certification: Pretesh Biswas has held IRCA certified Lead Auditor for ISO 9001,14001 and 27001. He holds a Bachelor of Engineering degree in Mechanical Engineering and is a MBA in Systems and Marketing. Prior to becoming a business consultant 6 years ago, he has worked in several portfolios such as Marketing, operations, production, Quality and customer care. He is also certified in Six Sigma Black belt . View all posts by Pretesh Biswas

Published August 1, 2019February 5, 2023

5.1 Leadership and commitment

Implementing a Security Strategy

5.2 Policy

5.3 Organizational roles, responsibilities and authorities

Roles and Responsibilities

Resources

Training and Awareness

Example of Consolidated Roles and Responsibilities

1) Executive Vice President and Chief Information Officer

2) Chief Postal Inspector

3) Vice President, Information Technology

4) Manager, Computer Operations

5) Manager, Corporate Information Security Office

6) Information Security Executive Council

8) Vice President, Engineering

9) Vice President, Network Operations

10) Officers and Managers

11) Executive Sponsors

12) Functional System Coordinators

13) Business Relationship Management Portfolio Managers

14) Managers of Information Technology Solution Centers

15) Installation Heads

16) Chief Privacy Officer

17) Inspector General

18) Manager, Business Continuance Management

19) Manager, Telecommunications Services

20) Managers Responsible for Computing Operations

21) Manager, Corporate Information Security Office, Information Systems Security

22) Managers, Help Desks

23) Contracting Officers and Contracting Officer Representatives

24) General Counsel

25) Business Partners

26) Accreditor

27) Certifier

28) Security Control Officers

29) Information Systems Security Representatives

30) Information Systems Security Officers

31) System and Network Administrators

32) Database Administrators

33) All Personnel

Back to Home Page

Share this:

Like this:

Related

Published by Pretesh Biswas

Leave a Reply Cancel reply