Skip to main content

Process of developing IS security plan

Short answer

Developing an IS security plan begins with defining scope and identifying assets, threats and vulnerabilities. After risk assessment, security policy and controls (physical, technical, administrative) are selected, followed by contingency plans. The plan is implemented, tested through audits and drills, and regularly reviewed to adapt to new threats.

Explain the process of developing an I.S. security plan.

An IS security plan is a documented strategy that defines what must be protected, from which threats, using which controls, and who is responsible. It is developed as a continuous cycle.

 Identify assets -> Assess risk -> Set policy
        ^                              |
 Review/Audit <- Implement <- Select controls

Steps

  1. Define scope and obtain management support - decide which systems, data and locations are covered; get budget and commitment.
  2. Identify and classify assets - hardware, software, data, people; rank by value and sensitivity.
  3. Identify threats and vulnerabilities - malware, hacking, insider misuse, natural disaster, weak configuration.
  4. Risk assessment - estimate likelihood and impact of each threat; prioritise risks.
  5. Set security policy and objectives - rules for access, passwords, acceptable use, backup, incident handling.
  6. Select controls - physical, technical (firewall, encryption, authentication) and administrative (training, separation of duties), by cost versus risk reduction.
  7. Prepare contingency plans - backup, disaster recovery and business continuity plans.
  8. Implement the plan - assign roles, install controls, train staff.
  9. Test, monitor and audit - penetration tests, audit logs, drills.
  10. Review and update regularly as technology and threats change.

✓ Answer checked by Claude Opus 5.5 (high effort)

Related questions

All Information System chapter 2 questions →