Day 1
GETTING STARTED – An enterprise-wide information
classification policy defines how information assets are
to be protected, provides guidance to employees on
how to classify information assets and encourages the
proper handling of sensitive information in whatever
form or media it exists.
The seminar will begin with an examination of the
National Institute of Standards and Technology's
(NIST) recommended structure of a topic-specific policy.
We'll flesh out the information classification policy
using standards recommended in the Information
Security Standard ISO 17799 (Asset Classification
5.1.1) Attendees will then explore and critique some
current examples of information classification policies.
POLICY STATEMENT DEVELOPMENT – After critiquing
a few existing policies, attendees will break up
into groups and develop a draft asset classification policy,
which we'll critique and edit together. Attendees
will receive a copy of each of the final policies completed
by the groups.
EMPLOYEES' RESPONSIBILITIES – Who will be
responsible for assigning the classification category to
each asset? We'll explore the elements of a policy on
employee responsibility, examining different examples,
and defining the terms owner, custodian and user.
|
Day 2
INFORMATION CLASSIFICATION METHODOLOGY – An effective information
classification process will provide management
and employees with a method for
identifying information assets as well as guidance
on how the information should be classified. This
can be achieved through brainstorming, keeping a
daily activity log of information records used during
normal business, or completing an information records
worksheet. We'll examine the pros and cons of each
method, giving attendees examples of each process to
use at their workplace.
INFORMATION HANDLING MATRIX – We'll create a
set of standards giving employees clear-cut guidance
on how to handle information based on its classification
level. We'll use existing examples as attendees
review the material and identify modifications needed
for their organization.
|
