Section I: Governance Issues

Chapter List

Chapter II: Aligning Assurance Requirements, Countermeasures, and Business

Chapter III: Protecting Customer Provided Information

Chapter IV: Global IT Risk Management Strategies

Balancing Access with Control

How does management determine who should have access to some information and not have access to other information? Would giving everyone access to all information mean a total loss of management control? How can control be managed when customers want to have direct access to their information 24 x 7 through public portals?

This section examines several key areas of focus critical to balancing access with control mechanisms. First is a detailed chapter on aligning security, countermeasures and business process elements that require substantial senior management decisions and direction on, as they form the framework for the overall IT architecture and technology purchased to support it.

Next comes a detailed discussion about protecting customer provided information a key element in every information security plan. The next major chapter focuses on multiple aspects of risk management, specifically people, processes, technology and the hierarchy of controls.

Toward the end of the section are discussions on the costs and benefits of IT security programs, trusting trusted systems, and best practices for sharing data outside the organization.