Information Systems Security Policy Update

Product Update Notification

Information Systems Security Policy Update 08/30/06 Detail

Topic 24 - Security Monitoring Policy. Formerly Topic 19 "Intrusion Detection Systems and Monitoring", this section contains the following subtopics:

General

Activity Monitoring

Network intrusion Detection System

Honeypot

Host intrusion Detection System

Log Transmission, Normalization, Storage and Protection

Intrusion Response Procedures

Topic 25 - Condition Monitoring Policy. New section includes the following subtopics:

General

Self Assessments

Metrics

Independent Tests

Key Factors

Topic 26 - Incident Response and Preparedness Policy. Formerly Topic 35, this section contains the following subtopics:

General

Security Response Center

When Customer Notice Should be Provided

When Customer is Not Required

Corrective Standards

Corrective Procedures

Internal Security Violation Procedures

News Media Communications

Topic 27 - Security Process and Monitoring Update Policy. New section that contains the following subtopics:

General

Monitoring

Updating

Topic 28 - Core Processing Policy. Formerly Topic 11, this section contains the following subtopics:

General

Separation of Duties

Transaction Processing Standards

Security Standards

Management Reporting Standards

System Specification Standards

Custom Report Standards

Auditing Standards

Computer Operations Controls

Backup Standards

Business Continuity Standards

Topic 29 - Internet Access Policy. Formerly Topic 26, this section contains the following subtopics:

General

Purpose and Scope

Risk Management

Internet Administration

Network Protection

Employee Use Standards

Employee Use Guidelines

Monitoring Internet Access and Usage

Downloading Software from the Internet

Internet E-Mail Guidelines

Training

Breach of Security Procedures

Disciplinary Actions

Topic 30 - Audit Policy. New section includes the following subtopics:

General

Board of Directors and Audit Committee Responsibilities

Audit Officer Responsibilities

Audit Department Responsibilities

Technology Committee Responsibilities

External Auditor Responsibilities

Internal Audit Program

Risk Assessment and Risk Based Auditing

Audit Participation for Information Technology Projects

Internal Audit Outsourcing General Guidelines

Independence of the External Auditor

Audit Outsourcing Arrangement

Third Party Reviews of Technology Service Providers

Topic 31 - Naming Convention Standards - Network. Formerly Topic 14, includes the following subtopics:

Standard

File Server Standard

Workstation Standard

Folder and Share Name Standard

Printer Standard

Click here to continue the review of detailed changes.