|
------- INDEX AND GLOSSARY. DO NOT CHANGE OR DELETE! ----------
Open IT Policy Index
-
Acceptable Use, Administrative or Special Access (Policy)
-
Acceptable Use, Email (Policy)
-
Acceptable Use, Internet (Policy)
-
Acceptable Use, Virtual Private Network (VPN) (Policy)
-
Access Controls, Account (Policy)
-
Account Management (Policy)
-
Change Management (Policy)
-
Computer Virus Prevention (Policy)
-
Contingency Planning (Policy)
-
Data Backup and Storage (Policy)
-
Data Marking, Handling, Processing, Storage, and Disposal (Policy)
-
Deferral of System Security Certification or Accreditation, Annual (Form)
-
General Information Security Management (Procedure)
-
Green Computing (Policy)
-
Incident Response (Policy)
-
Intrusion Detection (Policy)
-
Logging and Audit Trails (Policy)
-
Mobile Computing and Network Access (Policy)
-
Network Access (Policy)
-
Network Access Controls (Standard)
-
Network Configuration (Policy)
-
Network Data Privacy (Policy)
-
Password Management (Policy)
-
Personnel Security (Policy)
-
Physical Security (Policy)
-
Policy Application Checklist (Administrative Utility)
-
Secure Media and Data Handling (Procedure)
-
Secure Software Development Lifecycle (Standard)
-
Social Computing and Networking (Policy)
-
Software and Hardware Security Controls (Policy)
-
Spam and Unsolicited Commercial Email Prohibition (Policy)
-
System Security Certification/Accreditation, Annual (Form)
-
System Security Certification/Accreditation, Annual (Policy)
-
Telecommuting Agreement, Employee (Form)
-------------------------------------------------------------------------------------------------
This checklist supports the efforts of departmental managers in tracking policies applicable to the organization(s) and system(s). The checklist is designed to facilitate administration of the entire policy lifecycle—from draft through adoption, publication, communication, review, and revision.
How to Use this Checklist
Required Policies
The checklist by default indicates the status of policies are required for [variable: Covered Organization or system(s)], based on the nature of the
Information Resources used by the organization. For each policy in the list:
-
Indicate “YES” in each column where the column heading indicates a true statement
-
Note a targeted completion date in each column where the column heading indicates a condition that is not yet met
Optional Policies
The checklist does not indicate the status of policies is required. [variable: Covered Organization or system(s)] should verify whether the policy is required, based on 1) the nature of the
Information Resources used by an organization, and 2) the requirements statement noted by each policy title.
If [variable: Covered Organization or system(s)] falls under the policy requirements noted:
-
Indicate “YES” under the “Required” column heading
-
Indicated Yes under each additional column heading that indicates a true condition
-
Note a targeted completion date in each column where the column heading indicates a condition that is not yet met
If the policy is not required based on the requirements statement simply mark the Required column “No.”
Policy Checklist Form
|
Required |
Drafted |
Published |
Approved |
Adopted |
Communicated |
Revised |
|
Acceptable Use |
|
Yes |
|
|
|
|
|
|
|
Account Management |
|
Yes |
|
|
|
|
|
|
|
Special Access Management |
|
Yes |
|
|
|
|
|
|
|
Change Management |
|
Yes |
|
|
|
|
|
|
|
Contingency Planning |
|
Yes |
|
|
|
|
|
|
|
Incident Response |
|
Yes |
|
|
|
|
|
|
|
Marking, Handling, Processing, Storage, and Disposal of Data |
|
Yes |
|
|
|
|
|
|
|
Data
Backup and Storage |
|
Yes |
|
|
|
|
|
|
|
Account Access and Passwords |
|
Yes |
|
|
|
|
|
|
|
Physical Access |
|
Yes |
|
|
|
|
|
|
|
Privacy |
|
Yes |
|
|
|
|
|
|
|
Security Training |
|
Yes |
|
|
|
|
|
|
|
Software License Management |
|
Yes |
|
|
|
|
|
|
|
Virus Detection |
|
Yes |
|
|
|
|
|
|
|
Intrusion Detection (Required for networked environments) |
|
? |
|
|
|
|
|
|
|
Network Access |
|
? |
|
|
|
|
|
|
|
Network Configuration |
|
? |
|
|
|
|
|
|
|
Portable Computing (Required for organizations supporting laptops, PDA, or other portable devices or media) |
|
? |
|
|
|
|
|
|
|
Network Security Monitoring |
|
? |
|
|
|
|
|
|
|
Server Hardening |
|
? |
|
|
|
|
|
|
|
Secure Software Development Lifecycle (Required for environments where software is developed) |
|
? |
|
|
|
|
|
|
|
Vendor Access (Required for environments where third-parties access
information resources) |
|
? |
|
|
|
|
|
|
References
Tool model(s)
State of Texas, Department of Information Resources
|