Asset Management by https://padlet.com/riyabiren_mehta/ohqdy6cecsdb Asset Management Policy en-us 2018-11-03 18:11:16 UTC 2018-11-05 11:11:33 UTC hello@padlet.com All information assets and systems must have an assigned owner. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094538 2018-11-03 18:18:07 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094538 The Office of Information Security will maintain an inventory of information asset ownership. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094564 2018-11-03 18:18:23 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094564 Owners are required to classify information and information systems in accordance with the organizational classification guidelines. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094610 2018-11-03 18:18:43 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094610 Owners are responsible for determining the required level of protection. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094701 2018-11-03 18:19:20 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094701 Owners must authorize internal information and information system access rights and permissions. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094748 2018-11-03 18:19:51 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094748 Owners must review and reauthorize access rights and permissions on an annual basis. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094796 2018-11-03 18:20:07 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094796 Owners must authorize third-party access to information or information systems. This includes information provided to a third party. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094822 2018-11-03 18:20:22 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094822 Implementation and maintenance of controls is the responsibility of the Office of Information Security; however, accountability will remain with the owner of the asset. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094856 2018-11-03 18:20:37 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094856 The company will use a four-tiered data classification schema consisting of protected, confidential, restricted, and public. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094912 2018-11-03 18:21:10 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300094912 The criteria for each level will be maintained by and available from the Office of Information Security. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095116 2018-11-03 18:23:08 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095116 All information will be associated with one of the four data classifications. It is the responsibility of information owners to classify data. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095149 2018-11-03 18:23:27 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095149 Information systems containing information from multiple classification levels shall be secured in accordance with the requirements of the highest classification level. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095175 2018-11-03 18:23:41 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095175 Data classification will remain in force regardless of the location or state of the data at any given time. This includes backup and archive media and locations. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095204 2018-11-03 18:23:57 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095204 The classification system will allow that classifications of information assets may change over time. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095219 2018-11-03 18:24:12 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095219  Each classification shall have documented handling requirements. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095251 2018-11-03 18:24:28 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095251 Each classification of data will have documented handling standards for the following categories: storage, transmission, communication, access, logging, retention, destruction, disposal, incident management, and breach notification. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095371 2018-11-03 18:25:34 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095371 Each classification will have labeling requirements. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095388 2018-11-03 18:25:46 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095388 The Office of Information Security is responsible for the development and implementation of labeling and handling standards. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095423 2018-11-03 18:26:00 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095423 All employees, contractors, and affiliates will be provided or have access to written documentation that clearly describes the labeling and handling standards. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095453 2018-11-03 18:26:17 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095453 All employees, contractors, and affiliates will be provided with a resource that questions can be directed to. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095480 2018-11-03 18:26:32 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095480  All employees, contractors, and affiliates will be provided with a resource that violations can be reported to. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095506 2018-11-03 18:26:48 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095506 All information system assets shall be identified and documented with their classification, owner, location, and other details according to standards published by the Office of Information Security. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095619 2018-11-03 18:27:55 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095619 Company assets must be accounted for at all times. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095655 2018-11-03 18:28:13 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095655 The Office of Information Security will maintain the inventory documentation. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095691 2018-11-03 18:28:33 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095691 Copies of all inventory documentation will be included in the Business Continuity Plan. riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095726 2018-11-03 18:28:48 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095726 ISO 27002:2013 Section 8 Asset Management riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095788 2018-11-03 18:29:15 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095788 NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095807 2018-11-03 18:29:27 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095807 NIST SP 800-88 Guidelines for Media Sanitization riyabiren_mehta https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095850 2018-11-03 18:29:53 UTC https://padlet.com/riyabiren_mehta/ohqdy6cecsdb/wish/300095850