Information Security Planning and Policy: NIST Standards

Catalog description

The United States government requires all federal systems to have a customized security plan. In addition, the National Training Standard for Information Systems Security (INFOSEC) Professionals requires programs that meet his standard to produce students capable of developing a security plan; this course provides an introduction to security planning as recommended by NIST guidelines on developing security plans. The student is required to conduct a case study where a security plan is developed for a fictitious or real small size organization. The purpose of this course is to provide an overview of the security requirements on existing computing environment and describe the controls in place or planned for meeting those requirements. The security plan presents all managerial, operational, and technical controls and organization will need in the next three years. The purpose, scope, and content of a security plan are covered in the first week of lecture. Several outlines for a security plan are shown from the following sources: OMB Circular A-130 (2), NIST Special Publication 800-18 (1), and Director of Central Intelligence (DCID) 6/3.