Create an organization chart (use Visio or Dia) which illustrates the roles that will be required to ensure the design, evaluation, implementation, and management of security programs for the organization.
Within your organizational chart, clearly identify the reporting structure for roles such as IT Security Compliance Officer, Security Manager, CIO, CISO, IT Security Engineer, Privacy Security Professional, and IT Procurement Specialist.
List the types of resources required to fulfill each forensic duty of the organization below each of the roles you identified.
Align your organization chart to reflect the Department of Homeland Security (DHS) Essential Body of Knowledge’s three areas of information security: physical security professional, privacy professional, and procurement professional.
Provide comments and comparisons on how your organizational chart fosters these three values.
Request for Proposal (RFP) plan
Develop a Request for Proposal (RFP) plan to solicit qualified vendors that could partner with your internal team to deliver optimum IT service delivery.
The RFP Plan should contain qualifying criteria of potential vendors and the responsibilities of the vendor once the contract is awarded.
As part of the plan, you must:
Describe at least two perspectives that need to be closely monitored within the contract.
Give your perspective on at least two methods that could be used to evaluate and develop a qualified trusted supplier list.
Physical Security Plan
Recommend a physical security plan that could be used to protect sensitive areas such as telecom rooms, employee-only areas, and manufacturing facilities in which you include at least three specific methods.
Enterprise Information Security Compliance Program
Establish an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you describe specific plans and control objectives that could be adopted to address the known issues.
Suggest at least three information security policies that could be developed and practiced within the organization for data security assurance.
Outline the steps you would take to define the security needs of the organization in terms of duties, staffing, training, and processes.
Risk Management Plan
Develop a risk management plan in which you describe at least three possible risk management efforts that could be used to assess threats and unknown issues.
Determine why defining priorities is an important part of the process when enumerating and having efficient risk control measures.
Suggest specific technical and management controls that could be enacted in order to monitor risks accurately.
