Process

Security Process Development

Security policies and standards require clear, concise, well defined security processes to make them effective. SSG's experienced security specialists will help you define and document the processes which enable your security objectives to be realized. The processes will be developed based on your organization's predefined information security standards or a standards-based code of practice.

You may select the particular processes you want SSG to address or, alternatively, you may elect to have SSG first perform a comprehensive Security Process Assessment to help prioritize the areas your organization should focus on first for maximum benefit. The following are examples of security processes that can be customized for your organization as part of this offering:

• roles and responsibilities of security staff members
• classification and protection of information media
• employee awareness programs
• incident reporting and response
• enterprise-wide anti-virus measures
• user and password management
• management self-assessment programs.

In order to develop processes that meet your business objectives and can be implemented easily within your organization, SSG security consultants will first review and assess the security processes you have selected at one or more locations using an IT Process Model and a standards-based model of "best practices". The assessment will identify both the strengths and weaknesses in the processes as they are currently implemented. Using this information, SSG will define and formally document new processes that will meet your business needs for efficiency, effectiveness and adaptability by using a formal process management methodology.

Range of Services

• review of your organization's security policy, relevant standards and documentation for the selected processes
• assessment of your current processes (within the selected scope) in terms of effectiveness, efficiency and adaptability using an IT Process Model and a standards-based model of "best practices"
• formal process definitions using SSG's business process methodology. Each process definition will include the following information:
  • purpose
  • intended audience
  • owner
  • version number
  • approval date
  • revision history
  • revision process
  • process flow diagram
  • supplier responsibilities
  • customer responsibilities
  • tasks and quality controls