Policy Reference
| Category |
IT Security and Control |
| Approval Date |
|
| Scope |
ITS Personnel |
Purpose
This policy provides proactive guidelines to protect the City network from potential malicious attacks. Policies and procedures will be written to identify threats, vulnerabilities and risks.
Policy
- The City will develop, disseminate, and review: 1) a formal security and internal control framework policy that addresses purpose, scope, RACI info, and compliance; and 2) formal procedures to facilitate implementing the policy.
- The IT security policy will have an annual process to identify threats, vulnerabilities, and risks.
- The IT security policy and procedures will be reviewed when the environment changes, or at least annually, and then document and distribute the updated policies and procedures.
- IT Management will ensure that the security framework contains procedures for continuous monitoring for security alerts and security information. In addition, the security framework will include procedures for timely security incident, response, escalation and for continuous user account and authentication management.
Compliance
- The organization must develop, publish, maintain, and distribute a security policy and must address all of the PCI DSS requirements. § 12.1, § 12.1.1, Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers, Version 1.2
- Ensure that the organization maintains a list of all wireless devices and personnel authorized to use the devices. § 4.6.1.C, Payment Card Industry (PCI) Information Supplement: PCI DSS Wireless Guideline, Version 1.2, July 2009
- The organization must ensure the security policy contains procedures for identifying threats and vulnerabilities through an annual risk assessment. 12.1.2, Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers, Version 1.2
- The organization should develop a security policy for all mobile handheld devices. The security poicy should include required safeguards; cover the full lifecycle of the device; state any restrictions on personal use, such as storing contacts, music, and photos; and state implications on what could occur if a device that contains personal information is lost, stolen, damaged, or erased remotely. Pg ES-2, § 4.2.1, Guidelines on Cell Phone and PDA Security, NIST Special Publication 800-124, October 2008