I purchased a previous paper from you.

Sigchi4life
Category:
Computer Science
Price: $40 USD

Question description

Term Paper: The Rookie Chief Information Security Officer

This assignment consists of five (5) parts:

     Part 1: Organization Chart
     Part 2: Request for Proposal (RFP) Plan
     Part 3: Physical Security Plan
     Part 4: Enterprise Information Security Compliance Program
     Part 5: Risk Management Plan

Imagine that you have been recently promoted to serve as Chief Information Security Officer (CISO) for a Fortune 500 organization. This organization has known brand products across the world and expects top-secret methods for safeguarding proprietary information on its recipes and product lines. The Board of Directors request that their information security strategy be upgraded to allow greater opportunities of secure cloud collaboration between suppliers and resellers of their products. Another concern they have is the recent number of hacktivist attacks that have caused the network to fail across the enterprise. Their concern extends to making sure that they have controlled methods for accessing secured physical areas within their various regional facilities.

For your new position, you will be responsible for developing standards, methods, roles, and recommendations that will set the new IT security path for the organization. The existing organization has limited experience in supporting an enhanced level of IT security; therefore, you may need to outsource certain security services.

Additionally, you may create and / or assume all necessary assumptions needed for the completion of this assignment.
Write an eight to twelve (8-12) page paper in which you provide the following deliverables:

Part 1: Organization Chart

1. Use Visio or an Open Source alternative, such as Dia, to:
    a. Create an organization chart in which you:
         i.   Illustrate the roles that will be required to ensure design, evaluation, implementation, and management of security programs 

              for the organization.
         ii.  Within your organizational chart, clearly identify the reporting structure for roles such as IT Security Compliance Officer, 

              Security Manager, CIO, CISO, IT Security Engineer, Privacy Security Professional, and IT Procurement Specialist.
         iii. List the types of resources required to fulfill the each forensic duty of the organization below each of the roles you identified.
         iv. Align your organization chart to reflect the Department of Homeland Security (DHS) Essential Body of Knowledge’s three (3) 

             areas of information security: physical security professional, privacy professional, and procurement professional. Provide 

             comments and comparisons on how your organizational chart fosters these three (3) values.

Part 2: Request for Proposal (RFP) Plan

2. Develop a Request for Proposal (RFP) plan to solicit qualified vendors that could partner with your internal team to deliver optimum 

    IT service delivery. The RFP Plan should contain qualifying criteria of potential vendors and the responsibilities of the vendor once 

    the contract is awarded. As part of the plan, you must:
    a. Describe at least two (2) perspectives that need to be closely monitored within the contract.
    b. Give your perspective on at least two (2) methods that could be used to evaluate and develop a qualified trusted supplier list.

Part 3: Physical Security Plan

3. Recommend a physical security plan that could be used to protect sensitive areas such as telecom rooms, employee only areas, 

    and manufacturing facilities in which you:
    a. Include at least three (3) specific methods.

Part 4: Enterprise Information Security Compliance Program

4. Establish an enterprise information security compliance program that addresses the concerns of the board of directors of the 

    organization in which you:
    a. Describe specific plans and control objectives that could be adopted to address the known issues.
    b. Suggest at least three (3) information security policies that could be developed and practiced within the organization for data 

        security assurance.
    c. Outline the steps you would take to define the security needs of the organization in terms of duties, staffing, training, and 

        processes.

Part 5: Risk Management Plan

5. Develop a risk management plan in which you:
     a. Describe at least three (3) possible risk management efforts that could be used to assess threats and unknown issues.
     b. Determine why defining priorities is an important part of the process when enumerating and having efficient risk control 

         measures.
     c. Suggest specific technical and management controls that could be enacted in order to monitor risks accurately.

6. Use at least three (3) quality resources in this assignment. Note: Wikipedia and similar Websites do not qualify as quality 

    resources.

Your assignment must follow these formatting requirements:

  • Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.
  • Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date. The cover page and the reference page are not included in the required assignment page length.
  • Include charts or diagrams created in Visio or one of its equivalents such as Dia. The completed diagrams / charts must be imported into the Word document before the paper is submitted.
The specific course learning outcomes associated with this assignment are:

  • Describe and apply the 14 areas of common practice in the Department of Homeland Security (DHS) Essential Body of Knowledge.
  • Describe best practices in cybersecurity.
  • Describe physical security plans and processes.
  • Evaluate the ethical concerns inherent in cybersecurity and how these concerns affect organizational policies.
  • Explain legal and regulatory compliance practices.
  • Explain risk management plans and policies.
  • Describe physical security plans and processes.
  • Develop a cybersecurity plan that incorporates the Department of Homeland Security (DHS) Essential Body of Knowledge.
  • Identify the strategic management issues in cybersecurity planning and response.
  • Explain data security competencies to include turning policy into practice.
  • Compare and contrast the functional roles of an organization in the context of cybersecurity.
  • Identify and analyze the role of the Chief Information Officer, Information Security Officer, and IT Security Compliance Officer in the context of cybersecurity.
  • Use technology and information resources to research issues in cybersecurity.
  • Write clearly and concisely about topics associated with cybersecurity using proper writing mechanics and technical style conventions.

Term Paper: The Rookie Chief Information Security Officer

Criteria

Unacceptable

Below 60% F

Meets Minimum Expectations

60-69% D

Fair

70-79% C

Proficient

80-89% B

Exemplary

90-100% A

Part 1: Organization Chart

1ai. Use Visio or an Open Source alternative, such as Dia, to create an organization chart in which you illustrate the roles that will be required to ensure design, evaluation, implementation, and management of security programs for the organization.

Weight: 5%

Did not submit or incompletely used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you illustrated the roles that will be required to ensure design, evaluation, implementation, and management of security programs for the organization.

Insufficiently used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you illustrated the roles that will be required to ensure design, evaluation, implementation, and management of security programs for the organization.

Partially used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you illustrated the roles that will be required to ensure design, evaluation, implementation, and management of security programs for the organization.

Satisfactorily used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you illustrated the roles that will be required to ensure design, evaluation, implementation, and management of security programs for the organization.

Thoroughly used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you illustrated the roles that will be required to ensure design, evaluation, implementation, and management of security programs for the organization.

1aii. Use Visio or an Open Source alternative, such as Dia, to create an organization chart in which you clearly identify the reporting structure for roles such as IT Security Compliance Officer, Security Manager, CIO, CISO, IT Security Engineer, Privacy Security Professional, and IT Procurement Specialist.

Weight: 5%

Did not submit or incompletely used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you clearly identified the reporting structure for roles such as IT Security Compliance Officer, Security Manager, CIO, CISO, IT Security Engineer, Privacy Security Professional, and IT Procurement Specialist.

Insufficiently used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you clearly identified the reporting structure for roles such as IT Security Compliance Officer, Security Manager, CIO, CISO, IT Security Engineer, Privacy Security Professional, and IT Procurement Specialist.

Partially used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you clearly identified the reporting structure for roles such as IT Security Compliance Officer, Security Manager, CIO, CISO, IT Security Engineer, Privacy Security Professional, and IT Procurement Specialist.

Satisfactorily used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you clearly identified the reporting structure for roles such as IT Security Compliance Officer, Security Manager, CIO, CISO, IT Security Engineer, Privacy Security Professional, and IT Procurement Specialist.

Thoroughly used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you clearly identified the reporting structure for roles such as IT Security Compliance Officer, Security Manager, CIO, CISO, IT Security Engineer, Privacy Security Professional, and IT Procurement Specialist.

1aiii. Use Visio or an Open Source alternative, such as Dia, to create an organization chart in which you list the types of resources required to fulfill the each forensic duty of the organization below each of the roles you identified.

Weight: 5%

Did not submit or incompletely used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you listed the types of resources required to fulfill the each forensic duty of the organization below each of the roles you identified.

Insufficiently used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you listed the types of resources required to fulfill the each forensic duty of the organization below each of the roles you identified.

Partially used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you listed the types of resources required to fulfill the each forensic duty of the organization below each of the roles you identified.

Satisfactorily used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you listed the types of resources required to fulfill the each forensic duty of the organization below each of the roles you identified.

Thoroughly used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you listed the types of resources required to fulfill the each forensic duty of the organization below each of the roles you identified.

1aiv. Use Visio or an Open Source alternative, such as Dia, to create an organization chart in which you align your organization chart to reflect the Department of Homeland Security (DHS) Essential Body of Knowledge’s three (3) areas of information security: physical security professional, privacy professional, and procurement professional.  Provide comments and comparisons on how your organizational chart fosters these three (3) values.

Weight: 10%

Did not submit or incompletely used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you aligned your organization chart to reflect the Department of Homeland Security (DHS) Essential Body of Knowledge’s three (3) areas of information security: physical security professional, privacy professional, and procurement professional; did not submit or incompletely provided comments and comparisons on how your organizational chart fosters these three (3) values.

Insufficiently used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you aligned your organization chart to reflect the Department of Homeland Security (DHS) Essential Body of Knowledge’s three (3) areas of information security: physical security professional, privacy professional, and procurement professional; insufficiently provided comments and comparisons on how your organizational chart fosters these three (3) values.

Partially used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you aligned your organization chart to reflect the Department of Homeland Security (DHS) Essential Body of Knowledge’s three (3) areas of information security: physical security professional, privacy professional, and procurement professional; partially provided comments and comparisons on how your organizational chart fosters these three (3) values.

Satisfactorily used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you aligned your organization chart to reflect the Department of Homeland Security (DHS) Essential Body of Knowledge’s three (3) areas of information security: physical security professional, privacy professional, and procurement professional; satisfactorily provided comments and comparisons on how your organizational chart fosters these three (3) values.

Thoroughly used Visio or an Open Source alternative, such as Dia, to create an organization chart in which you aligned your organization chart to reflect the Department of Homeland Security (DHS) Essential Body of Knowledge’s three (3) areas of information security: physical security professional, privacy professional, and procurement professional; thoroughly provided comments and comparisons on how your organizational chart fosters these three (3) values.

Part 2: Request for Proposal (RFP) Plan

2a. Develop a Request for Proposal (RFP) plan to solicit qualified vendors that could partner with your internal team to deliver optimum IT service delivery. The RFP Plan should contain qualifying criteria of potential vendors and the responsibilities of the vendor once the contract is awarded. As part of the plan, describe at least two (2) perspectives that need to be closely monitored within the contract.

Weight: 10%

Did not submit or incompletely developed a Request for Proposal (RFP) plan to solicit qualified vendors that could partner with your internal team to deliver optimum IT service delivery. The RFP Plan should contain qualifying criteria of potential vendors and the responsibilities of the vendor once the contract is awarded; did not submit or incompletely, as part of the plan, described at least two (2) perspectives that need to be closely monitored within the contract.

Insufficiently, as part of the plan, described at least two (2) perspectives that need to be closely monitored within the contract.

Partially, as part of the plan, described at least two (2) perspectives that need to be closely monitored within the contract.

Satisfactorily, as part of the plan, described at least two (2) perspectives that need to be closely monitored within the contract.

Thoroughly, as part of the plan, described at least two (2) perspectives that need to be closely monitored within the contract.

2b. Develop a Request for Proposal (RFP) plan to solicit qualified vendors that could partner with your internal team to deliver optimum IT service delivery. The RFP Plan should contain qualifying criteria of potential vendors and the responsibilities of the vendor once the contract is awarded. As part of the plan, give your perspective on at least two (2) methods that could be used to evaluate and develop a qualified trusted supplier list.

Weight: 10%

Did not submit or incompletely developed a Request for Proposal (RFP) plan to solicit qualified vendors that could partner with your internal team to deliver optimum IT service delivery. The RFP Plan should contain qualifying criteria of potential vendors and the responsibilities of the vendor once the contract is awarded; did not submit or incompletely, as part of the plan, gave your perspective on at least two (2) methods that could be used to evaluate and develop a qualified trusted supplier list.

Insufficiently, as part of the plan, gave your perspective on at least two (2) methods that could be used to evaluate and develop a qualified trusted supplier list.

Partially, as part of the plan, gave your perspective on at least two (2) methods that could be used to evaluate and develop a qualified trusted supplier list.

Satisfactorily, as part of the plan, gave your perspective on at least two (2) methods that could be used to evaluate and develop a qualified trusted supplier list.

Thoroughly, as part of the plan, gave your perspective on at least two (2) methods that could be used to evaluate and develop a qualified trusted supplier list.

Part 3: Physical Security Plan

3a. Recommend a physical security plan that could be used to protect sensitive areas such as telecom rooms, employee only areas, and manufacturing facilities in which you include at least three (3) specific methods.

Weight: 10%

Did not submit or incompletely recommended a physical security plan that could be used to protect sensitive areas such as telecom rooms, employee only areas, and manufacturing facilities in which you included at least three (3) specific methods.

Insufficiently recommended a physical security plan that could be used to protect sensitive areas such as telecom rooms, employee only areas, and manufacturing facilities in which you included at least three (3) specific methods.

Partially recommended a physical security plan that could be used to protect sensitive areas such as telecom rooms, employee only areas, and manufacturing facilities in which you included at least three (3) specific methods.

Satisfactorily recommended a physical security plan that could be used to protect sensitive areas such as telecom rooms, employee only areas, and manufacturing facilities in which you included at least three (3) specific methods.

Thoroughly recommended a physical security plan that could be used to protect sensitive areas such as telecom rooms, employee only areas, and manufacturing facilities in which you included at least three (3) specific methods.

Part 4: Enterprise Information Security Compliance Program

4a. Establish an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you describe specific plans and control objectives that could be adopted to address the known issues.

Weight: 5%

Did not submit or incompletely established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you described specific plans and control objectives that could be adopted to address the known issues.

Insufficiently established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you described specific plans and control objectives that could be adopted to address the known issues.

Partially established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you described specific plans and control objectives that could be adopted to address the known issues.

Satisfactorily established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you described specific plans and control objectives that could be adopted to address the known issues.

Thoroughly established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you described specific plans and control objectives that could be adopted to address the known issues.

4b. Establish an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you suggest at least three (3) information security policies that could be developed and practiced within the organization for data security assurance.

Weight: 5%

Did not submit or incompletely established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you suggested at least three (3) information security policies that could be developed and practiced within the organization for data security assurance.

Insufficiently established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you suggested at least three (3) information security policies that could be developed and practiced within the organization for data security assurance.

Partially established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you suggested at least three (3) information security policies that could be developed and practiced within the organization for data security assurance.

Satisfactorily established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you suggested at least three (3) information security policies that could be developed and practiced within the organization for data security assurance.

Thoroughly established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you suggested at least three (3) information security policies that could be developed and practiced within the organization for data security assurance.

4c. Establish an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you outline the steps you would take to define the security needs of the organization in terms of duties, staffing, training, and processes.

Weight: 5%

Did not submit or incompletely established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you outlined the steps you would take to define the security needs of the organization in terms of duties, staffing, training, and processes.

Insufficiently established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you outlined the steps you would take to define the security needs of the organization in terms of duties, staffing, training, and processes.

Partially established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you outlined the steps you would take to define the security needs of the organization in terms of duties, staffing, training, and processes.

Satisfactorily established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you outlined the steps you would take to define the security needs of the organization in terms of duties, staffing, training, and processes.

Thoroughly established an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you outlined the steps you would take to define the security needs of the organization in terms of duties, staffing, training, and processes.

Part 5: Risk Management Plan

5a. Develop a risk management plan in which you describe at least three (3) possible risk management efforts that could be used to assess threats and unknown issues.

Weight: 5%

Did not submit or incompletely developed a risk management plan in which you described at least three (3) possible risk management efforts that could be used to assess threats and unknown issues.

Insufficiently developed a risk management plan in which you described at least three (3) possible risk management efforts that could be used to assess threats and unknown issues.

Partially developed a risk management plan in which you described at least three (3) possible risk management efforts that could be used to assess threats and unknown issues.

Satisfactorily developed a risk management plan in which you described at least three (3) possible risk management efforts that could be used to assess threats and unknown issues.

Thoroughly developed a risk management plan in which you described at least three (3) possible risk management efforts that could be used to assess threats and unknown issues.

5b. Develop a risk management plan in which you determine why defining priorities is an important part of the process when enumerating and having efficient risk control measures

Weight: 5%

Did not submit or incompletely developed a risk management plan in which you determined why defining priorities is an important part of the process when enumerating and having efficient risk control measures

Insufficiently developed a risk management plan in which you determined why defining priorities is an important part of the process when enumerating and having efficient risk control measures

Partially developed a risk management plan in which you determined why defining priorities is an important part of the process when enumerating and having efficient risk control measures

Satisfactorily developed a risk management plan in which you determined why defining priorities is an important part of the process when enumerating and having efficient risk control measures

Thoroughly developed a risk management plan in which you determined why defining priorities is an important part of the process when enumerating and having efficient risk control measures

5c. Develop a risk management plan in which you suggest specific technical and management controls that could be enacted in order to monitor risks accurately.

Weight: 5%

Did not submit or incompletely developed a risk management plan in which you suggested specific technical and management controls that could be enacted in order to monitor risks accurately.

Insufficiently developed a risk management plan in which you suggested specific technical and management controls that could be enacted in order to monitor risks accurately.

Partially developed a risk management plan in which you suggested specific technical and management controls that could be enacted in order to monitor risks accurately.

Satisfactorily developed a risk management plan in which you suggested specific technical and management controls that could be enacted in order to monitor risks accurately.

Thoroughly developed a risk management plan in which you suggested specific technical and management controls that could be enacted in order to monitor risks accurately.

6. 3 references

Weight: 5%

No references provided

Does not meet the required number of references; all references poor quality choices.

Does not meet the required number of references; some references poor quality choices.

Meets number of required references; all references high quality choices.

Exceeds number of required references; all references high quality choices.

7. Clarity, writing mechanics, and formatting requirements

Weight: 10%

More than 8 errors present

7-8 errors present

5-6 errors present

3-4 errors present

0-2 errors present


Studypool has helped 1,244,100 students
Ask your homework questions. Receive quality answers!

Type your question here (or upload an image)

1827 tutors are online

Brown University





1271 Tutors

California Institute of Technology




2131 Tutors

Carnegie Mellon University




982 Tutors

Columbia University





1256 Tutors

Dartmouth University





2113 Tutors

Emory University





2279 Tutors

Harvard University





599 Tutors

Massachusetts Institute of Technology



2319 Tutors

New York University





1645 Tutors

Notre Dam University





1911 Tutors

Oklahoma University





2122 Tutors

Pennsylvania State University





932 Tutors

Princeton University





1211 Tutors

Stanford University





983 Tutors

University of California





1282 Tutors

Oxford University





123 Tutors

Yale University





2325 Tutors