Process

Security Process Assessment

Do you have confidence that your security processes are as efficient and effective as you would like? Are the right IT security processes in place to protect the information that is critical to the your business? Management processes and technology, working together, must cover all aspects of your business, including mechanisms used by hardware and software systems, networks, databases, human resource systems. SSG's Security Process Assessment will identify both strengths and weaknesses in your organization's IT security processes. When you are aware of the business exposures resulting from ineffective and inefficient security processes, you can begin to implement the changes that will provide the level of protection your business needs.

Compared to SSG's Security Health Check offering, this activity goes into sufficient depth to verify that each control selected has the right processes in place to implement the control. The review will be conducted against an agreed, predefined information security standard or code of practice using interviews with appropriate staff within the organization. SSG's security consultants will also verify the accuracy of the answers given by reviewing the actual processes and related documentation. This is done by inspecting examples of process deliverables or outputs provided by the individuals who are responsible for executing the processes being reviewed.

This controls assessment, at any given location, is designed to take four to six weeks depending on the number of processes selected from among more than seventy-five management controls contained in SSG's methodology. The breadth of the assessment can be corporate-wide, site by site, or for individual business units within your organization. Whatever scope you select, the results will provide you with business oriented recommendations for meeting your organization's security objectives with a repeatable assessment methodology.

Range of Services

• review of your organization's IT security processes and related documentation selected from the following ten management areas:
  1. policy
  2. organization
  3. personnel
  4. physical controls
  5. asset classification and control
  6. system access control
  7. network and computer management
  8. business continuity
  9. application development and maintenance
  10. compliance
• analysis of the information from interviews with key managers and process owners against SSG's standards-based model
• final report of the strengths and weaknesses found with business-oriented recommendations for process changes that could improve the efficiency and effectiveness of your organization's security program