In order to build on a program – the overall requirements of that program need to be developed. Some of them will be determined this week. For example, a bank has to be compliant with, at a minimum, state and federal laws. For purposes of this program we will try to focus on the laws and standards that apply regarding cybersecurity.
Completion Instructions:
For this week, there are several sections to complete:
4) Laws, compliance and framework requirements (30% points)
Laws that apply to the organization – describe at least two laws, and how they apply to the organization (they do not have to be specifically cyber related, but try).
Compliance related standards – describe at least two compliance related standards, and how they apply to the organization (PCI DSS is one example)
Aligned Standards – As earlier determined, the bank will be aligning to NIST 800-53r5. Also add the FFIEC Cybersecurity Assessment Tool (FFIEC CAT) – describe both at a high level.
You can leverage the material you posted in this week’s DB, ensure you add to it as necessary, as more is required here than was in the DB.
5) Data Classification Levels (60% points)
Define 3-5 data classification levels. Define and provide examples.
Be sure to include employee data in the determination, as well as customer data definitions.
6) Security Awareness Program (10% points)
For the discussion board material for this week – gather the Security Awareness program information and paste it in this section.
Discuss three annual activities that should be implemented at your organization to support the security awareness program.
One of these should be annual User Security Awareness Training.
For that section, provide a list of 8 topics/bullet points that will be in that training (Here is a starter list: Social Engineering, Insider threat, Phishing, etc.)
Submission Instructions:
Each week, more content will be added to it, you will always turn in the entire document each time. There are additional notes and comments on the template, remove them as you move through the completion of the template. For example, for the sections due this week, all of the comments, notes, and suggested text should be removed for those sections.
