Assignment Instructions Instructions: Do Exercise 7 or Exercise 8 below, but not both. Exercise 7: Privacy or Security Complaint to the Office of Civil Rights (OCR) Learning Objectives and Outcomes You will describe the process of submitting a privacy or security complaint to the OCR. Assignment Requirements Imagine that you are a sophomore at Premier College, living in Room 203, Graham Dormitory complex, 1212, University Road, Metropolis, West Virginia. The college requires you to maintain current medical and vaccination records as proof of your physical health. Over the past few months, you have not been well due to increased amounts of academic pressure. Also, your parents recently separated, and you found yourself unable to concentrate in class or sleep well at night. You went to the student medical center and requested some medicines to help you sleep. After consulting with the staff doctor, you were issued a prescription for the treatment of depression. On your second day of the class, your professor tells you that he too comes from a divided family and had to take medicine to help him cope with the situation. You ask him how he knew about your situation, and he replied that all student medical records were available to every instructor and staff member at Premier College, regardless of whether they are one of your instructors or not. Hearing this, you are highly dejected and feel that your privacy rights have been violated. You somehow wind up all your discussions with the instructor and rush towards your room. You have a sleepless night and you decide that the first thing you will do in the morning is to fight for your privacy. After researching for half a day, you learn that filing a privacy or security complaint to the OCR had been a tedious process before July 2009. You arrange for a meeting with a professional named Alex, who files such complaints. The next morning, you visit Alex and before anything else, you ask him to explain the new regulation for filing a privacy or security complaint. Alex narrates that on July 27, 2009, the Secretary of Health and Human Services (HHS) delegated to the Director of OCR the authority to administer and enforce the HIPAA Security Rule. He explains that this action improved HHS' ability to protect individuals' health information by combining the authority for administration and enforcement of federal standards for health information privacy and security. Those standards are outlined in the HIPAA legislation. Alex also emphasized the fact that with the new regulation, the process of filing a privacy or security complaint has become simpler and more effective. After hearing all this, you say goodbye to Alex and decide to file the complaint by yourself. A major reason for this is your limited financial means. You start filling out the form and realize that certain sections need clarity. Ignoring all these facts, you decide to continue filling out the form. As you fill out the form, you start getting interested in the whole process of filing a complaint. To ensure that what you are doing is right, you decide to find someone to validate your work. After pondering for a while, you think of your Uncle Samuel, who is working as a legal advisor with a well-known law firm. You write to Uncle Samuel describing all that has happened and you send him the complaint form. You share with your uncle that you would be interested in understanding the entire process. Uncle Samuel assigns you the following tasks before he helps you understand the process: 1.Identify the early iterations of the HIPAA act and how the law has been modified to facilitate easier access to consumer complaints and enforcement. 2.Identify specific sections of the form that need critical attention while filing the complaint 3.Analyze the situations that one gets into if the critical sections are not well identified. 4.Draft a brief summary, collating all your findings for your uncle’s review. Deliverables and format: Submit your answer in a Microsoft Word document in not more than 300 words. Font: Arial 10 point size Line Spacing: Double OR Exercise 8: Section 404 Learning Objectives and Outcomes This assignment will enable you to assess the compliance requirements of Section 404 and prepare a checklist to ensure Section 404 compliance. Assignment Requirements This assignment builds upon the role-play conducted in the roles section of this lesson. In this assignment, you play the role of an internal auditor. You’ve been given the task of creating a specific checklist to insure compliance with Section 404. You need to review the requirements of Section 404 and create a list identifying compliance requirements. The checklist should include information about reporting requirements, audits, IT security, and any other topics relevant to Section 404 compliance. The checklist should include information on internal controls over financial reporting (ICFR) controls as well as any known difficulties in complying with Section 404. Submission Instructions: Submit your answer in a Microsoft Word document in not more than 500 words. Font: Arial 10 point size Line Spacing: Double Assignment Grading Criteria 1. Content 50% 2. Writing Conventions (Grammar and Mechanics) 10% 3. Organization of Ideas/Format 300 Words 30% 4. Source (APA Format) 10%

Assignment Instructions Term Paper (8.4%): You must include at least ten references. Details of the Paper:Prepare a 10-15 page paper in Microsoft Word (counts as 15% of the final grade) in APA format (see writing expectations in the Policies section) (350 words per page). At a minimum include the following: References (minimum of 10) You may use resources from the APUS Online Library, any library, government library, or any peer-reviewed reference (Wikipedia and any other publicly-reviewed source is not accepted). The paper must by at least 10 pages double-spaced, 1" margin all around, black 12 point fonts (Times New Roman or Arial) with correct citations of all utilized references/sources, (pictures, graphics, etc are extra - allowed but extra for the minimum page count). The title page and references are also required but don't count in the minimum page count. A minimum of 10 references are needed.The paper will be subjected to checking against plagiarism. The paper must follow acceptable originality criteria (no more than 15% max total, and 2% per individual source match are allowed).Save the file using the following file naming convention: ITMG481_Project_First_Last.doc(x) (where first and last are your first and last names resp.) and submit the file in this assignment area.Turnitin.com has been enabled for this assignment so remember that your submission’s file type must be either doc or docx

PurposeThis course project is intended to assess your ability to comprehend and apply the basic concepts related to information security management, such as the following: §The ability to discern when a risk assessment should be performed and carrying out the task§Understanding user or customer access requirements, whether remote or local§Using a layered security approach to establish and maintain access controlsWorking with other departments, such as the human resources department, to identify and implement methods to prevent unwarranted exposure to information by inappropriate personnelYour ability to execute the tasks within these information security domains and others will be evaluated against the learning objectives as identified and described in previous lessons of instruction for this course.Required Source Information and ToolsWeb References:Links to Web references in this Instructor Guide and related materials are subject to change without prior notice. These links were last verified on August 2, 2014.The following tools and resources will be needed to complete this project:Course textbookAccess to the InternetAccess to the libraryText sheet: Integrated Distributors Incorporated (access_project_ts_integrateddistributors)Learning Objectives and OutcomesSuccessful completion of this project will ensure that you are capable of supporting the implementation and management of an information systems security framework. To be able to do so, you need to be able to do the following:§Relate how an access control policy framework is used to define authorization and access to an information technology (IT) infrastructure for compliance.§Mitigate risks to an IT infrastructure’s confidentiality, integrity, and availability with sound access controls.§Relate how a data classification standard influences an IT infrastructure’s access control requirements and implementation.§Develop an access control policy framework consisting of best practices for policies, standards, procedures, and guidelines to mitigate unauthorized access.§Define proper security controls within the User Domain to mitigate risks and threats caused by human nature and behavior.§Implement appropriate access controls for information systems within IT infrastructures.§Mitigate risks from unauthorized access to IT systems through proper testing and reporting.Project Checkpoints The course project has a checkpoint strategy. Checkpoint deliverables allow you to receive valuable feedback on your interim work. In this project, you have four ungraded checkpoint deliverables. (See the syllabus for the schedule.) You may discuss project questions with the instructor, and you should receive feedback from the instructor on previously submitted work. The checkpoint deliverable ensures refinement of the final deliverables, if incorporated effectively. The final deliverable for this project is a professional report and a PowerPoint presentation.CheckpointPurpose of the CheckpointExpected Deliverables1§Understanding requirements§Clarification on project deliverables§Discussion on project concerns and progress up to this checkpoint§A review of the course project’s outline and schedule for completionPrepare an initial outline of issues and potential solutions and discuss with your instructor, the chief information officer (CIO).2§Clarification on project deliverables§Discussion on project concerns and progress up to this checkpoint§A review of the course project’s outline and schedule for completionPrepare an extended outline of issues and potential solutions and discuss with your instructor, the CIO.3§Clarification on project deliverables§Discussion on project concerns and progress up to this checkpoint§A review of the course project’s outline and schedule for completionDraft the report and the PowerPoint presentation to discuss with your instructor, the CIO.4§Clarification on project deliverables§Discussion on project concerns and progress up to this checkpoint§A review of the course project’s outline and schedule for completionModify the report and the PowerPoint presentation based on feedback from your instructor, the CIO.DeliverablesIntroduction User identification, authentication, and authorization are essential in developing, implementing, and maintaining a framework for information system security. The basic function of an information system security framework is to ensure the confidentiality and the integrity, as well as the availability of systems, applications, and data. Certain information security implementation and management knowledge is required of network administrators, IT service personnel, management, and IT security practitioners, such as information security officers, security analysts, and domain administrators. ScenarioYou play the dual role of an IT architect and IT security specialist working for Integrated Distributors Incorporated (IDI), a multi-national organization with offices in several countries. Your instructor for this course plays the role of the chief information officer (CIO). Your peers play the role of selected technology staff. Each of the organization’s locations is operating with different information technologies and infrastructure—IT systems, applications, and databases. Various levels of IT security and access management have been implemented and embedded within their respective locations.TasksYour goals as the IT architect and IT security specialist are to:§Develop solutions to the issues that the specified location of IDI is facing.§Develop plans to implement corporate-wide information access methods to ensure confidentiality, integrity, and availability.§Assess risks and vulnerabilities with operating IT facilities in the disparate locations where IDI now functions and develop mitigation plans and implementation methods.§Analyze the strengths and weaknesses in the current systems of IDI.§Address remote user and Web site user’s secure access requirements.§Develop a proposed budget for the project—consider hardware, software, upgrades/replacements, and consulting services.§Prepare detailed network and configuration diagrams outlining the proposed change to be able to present it to the management.§Develop and submit a comprehensive report addressing the learning objectives and your solutions to the issues within the scenario.§Prepare a 10- to 15-slide PowerPoint presentation that addresses important access control, infrastructure, and management aspects from each location. Self-Assessment Checklist§I have considered an access control policy framework to define authorization and access to an IT infrastructure for compliance within the course project.§I have considered the influence of the data classification standard in an IT infrastructure’s access control requirements and implementation.§I have defined proper security controls within the User Domain to mitigate risk and threats caused by human nature and behavior.§I have developed and implemented an effective plan to mitigate risks to an IT infrastructure’s confidentiality, integrity, and availability with sound access controls.§I have developed an access control policy framework consisting of best practices for policies, standards, procedures, and guidelines to mitigate unauthorized access.§I have implemented appropriate access controls for information systems within IT infrastructures.§I have followed the submission requirements and necessary details for writing the report.😀 rU