Security

Information Security Policies Information Security Policies- An extensive set of ISO27k-based policies for universities from University Colleges and Information Systems Association. Standard Practice Guide Standard Practice Guide- Policy covering appropriate use of information resources and IT at the University of Michigan. Information Security Policy Information Security Policy- High-level information security policy statement for the Childhood Cancer Research Group at Oxford University. Privacy Policy Privacy Policy- One of many many examples on the WWW, this one from the School of Graduate Studies at Norwich University. Acceptable Use Policy Acceptable Use Policy- Template policy clarifying the acceptable use of IT devices and networks. [MS Word] Information Security Policies Information Security Policies- SANS consensus research project offering around 30 editable information security policies. eCommerce Privacy Policy eCommerce Privacy Policy- Policy concerning privacy of visitors to websites, covering logs, cookies and information volunteered. HIPAA Compliance Policy HIPAA Compliance Policy- From the University of North Carolina, Greensboro. Policy on compliance with the Health Insurance Portability and Accountability Act. Copyright Ownership and Use Policy Copyright Ownership and Use Policy- From the University of North Carolina, Greensboro. Policy on protecting the organization's own intellectual property through copyright. Copyright Compliance Policy Copyright Compliance Policy- From the University of North Carolina, Greensboro. Covers compliance with copyright law when using information belonging to others. Wireless Communications Policy Wireless Communications Policy- From the University of North Carolina, Greensboro. Prohibits wireless devices that may interfere with authorized wireless systems. Social Security Numbers Policy Social Security Numbers Policy- From the University of North Carolina, Greensboro. Specifies security controls to protect SSNs. Personal Information Security Breach Notification Policy Personal Information Security Breach Notification Policy- From the University of North Carolina, Greensboro. Policy about mandatory notification of breaches involving the disclosu… Identity Theft Prevention Program Policy Identity Theft Prevention Program Policy- From the University of North Carolina, Greensboro. Lays out controls for detecting and reacting to 'red flag' situations linked to identi… Electronic Records Retention Policy Electronic Records Retention Policy- From the University of North Carolina, Greensboro. Covers the retention of various data files, including those subject to litigation. Data Classification Policy Data Classification Policy- From the University of North Carolina, Greensboro. Deliberately simple: defines just two classification levels. Includes responsibilities. Acceptable Use of Computing and Electronic Resources Policy Acceptable Use of Computing and Electronic Resources Policy- From the University of North Carolina, Greensboro. Specifies responsibilities and prohibited activities in relation to… Third Party Connectivity Policy Third Party Connectivity Policy- From the State of Vermont Agency of Administration. Connections require business cases, audits etc. Physical Security for Computer Protection Policy Physical Security for Computer Protection Policy- From the State of Vermont Agency of Administration. Covers physical access controls and the secure provision of power etc. to a c… Intrusion Detection and Prevention Policy Intrusion Detection and Prevention Policy- From the State of Vermont Agency of Administration. Policy on specifying, installing and using IDS/IPS. Incident Response Policy Incident Response Policy- From the State of Vermont Agency of Administration. Policy defining the essential elements of the process for responding to security incidents. Antivirus Policy Antivirus Policy- From the State of Vermont Agency of Administration. Mandates the use of antivirus software on applicable systems. Acceptable Use Policy Template Acceptable Use Policy Template- A basic acceptable use policy, from the State of California Office of Information Security. [MS Word] Information Security Policies Information Security Policies- Policies from CSPO Tools Inc., some of which are available without charge as PDF files or for an annual subscription as MS Word files, along with ad… FIPS 140-2 Security Policy FIPS 140-2 Security Policy- Security policy for the OpenSSL FIPS software object module, required for validation against FIPS (Federal Information Processing Standard) 140-2. Campus Security Policy Campus Security Policy- A high level information security policy from Washington University. Campus Security Policy Campus Security Policy- An overarching security policy from Berkeley University includes links to more specific and detailed policies. Backup Policy Backup Policy- Sample policy requires a cycle of daily and weekly backups (although monthly backups are also advisable!). University Information Security Policies University Information Security Policies- A set of information security policies from the University of Louisville. Disaster Recovery Policy Disaster Recovery Policy- Basic DR policy in just over one side. Internet Acceptable Use Policy Internet Acceptable Use Policy- One page Acceptable Use Policy example. Personnel Security Policy Personnel Security Policy- Example policy covering pre-employment screening, security policy training etc. Network Security Policy Guide Network Security Policy Guide- Watchguard's guide to creating an overarching network information security policy, supported by subsidiary policies. Telecommuting/Teleworking Policy Telecommuting/Teleworking Policy- Sample policy on teleworking covering employment as well as information security issues. ISO/IEC 27001 Policies ISO/IEC 27001 Policies- Typical headings for a security policy aligned broadly with the ISO/IEC 27002 standard for information security management systems. University Information Security Policies University Information Security Policies- Electronic resource usage and security policies from the University of Pennsylvania. HIPAA Survival Guide HIPAA Survival Guide- Provides complete cross-linked HITECH Act and HIPAA regulation text with summaries and commentary on pertinent topics. HIPAA Full Text HIPAA Full Text- The complete reference text of HIPAA in direct browsable format. Department of Health & Human Services - HIPAA Department of Health & Human Services - HIPAA- The official central governmental hub for all HIPAA issues including rules, standards and implementation guides. SafetySend SafetySend- HIPAA compliant software solutions such as secure email, secure gateway, and HIPAA compliance information. FullArmor FullArmor- Providers of group policy management solutions for Active Directory. Security Ontology Security Ontology- The security ontology offers innovative software solutions in the areas of IT-security, semantic technologies, and sustainability. SaaSAssurance SaaSAssurance- Provides a software solution for implementation and ongoing management of information security standards. The Mobile Resource Group The Mobile Resource Group- Offers CMDSP, a certification in the field of mobile device security. High-Tech Bridge SA High-Tech Bridge SA- Offers ethical hacking by penetration testing, website and web application vulnerability scanning, Computer crime investigation and prevention expert services… ProtectMyNet ProtectMyNet- Provides network security best practices, tips, news, and consulting for businesses, government and educational markets. Secunets Technologies Secunets Technologies- Offers consultancy services specialising in S.S.L Certificate installation and open source. Sailpoint IdentityIQ Software Sailpoint IdentityIQ Software- Offers an identity governance solution intended to reduce the cost, complexity and burden of security and compliance initiatives. Minuteman Governance Minuteman Governance- Develops comprehensive data governance strategies with emphasis on data protection. EnLogica Solutions EnLogica Solutions- Provides IT Security, Information Assurance, IT Architecture, Engineering, Operation and Maintenance services to commercial and Government customers.