unit-7-power-point-final 1 .pptx - Unit 7: Organisational...

Unit 7: Organisational
Systems Security
Task 3 – P4 Explain the policies and guidelines for managing organizational IT security
issues/P5 Explain how employment contracts can affect security/P6 Review the laws
related to security and privacy of data/M3 Explain the role of ethical decision making
in organizational IT security/D2 Evaluate the security policies used in an organization

Security Policies and guidelines
• Disaster recovery Policies: Also known as DR is a type of security planning that is used as a way to protect a
businesses data and major functions. This is used to protect a business from the effects of large negative events for
example floods and fires as well as something like a virus or malware. This plan usually uses backups of data stored
in a different location of where they are as if there was to be a fire the main system might be affected but the
backup system with all the saved data is in a different location that is safe.
• Updating security procedures: This is very important as security is one of the top priorities in a business. It is very
important for a business to update their security procedure on a frequent basis as it means they will be protected
against the latest threats that would have been able to get through their older security system. If they don’t do this
often they put their systems at risk as the older the security procedure the more likely new malicious software’s
like viruses are to infect the system.
•
Scheduling of security audits: This is a systematic evaluation of the security procedures a business is using with
their information system. This checks whether the security they are using conforms to a set of established rules as
well as how close it is to these criteria. It is a good idea for the business to schedule it as it means they can keep on
top of how well their security system is and doing so allows them to know when they need to update it and
improve the security procedures.
•
Codes of conduct: This is a set of rules that all employees must abide by when using the businesses system so that
the business can ensure that employees are only using the system for what it is meant to be used for and nothing
else. This is not only to keep employees doing work but to also keep the system secure as if an employee was to
use the system for their personal use they could end up downloading malicious software which will greatly damage
the system. These codes of conduct will usually go over things like not being able to use your personal email while
at work and using the business’s system to ensure security as well as going over internet usage policies. These
policies will be about how you cannot use certain things on the internet like dangerous websites as well as things
like social media as this is all to keep the business system secure as well as everything on it.