/Users/andrea/_magisterarbeit/korpus/clean/trainkorpus/26/file_69.html NN ----------------------------------------- : III NP . SENT Guidelines NNS for IN IT PP Security NP Policy NP 1 CD . SENT Positioning NN and CC Basic JJ Structure NN of IN the DT Security NP Policy NP The DT system NN of IN the DT IT PP Security NP Policy NP has VHZ a DT hierarchical JJ structure NN as IN shown VVN in IN Fig NN . SENT 2 LS . SENT At IN the DT apex NN is VBZ the DT Government's NP basic JJ concepts NNS of IN IT PP security NN , , which WDT illustrates VVZ how WRB the DT Government NN , , as IN a DT whole NN , , feels VVZ about IN the DT measures NNS for IN IT PP security NN . SENT The DT basic JJ concepts NNS are VBP followed VVN by IN the DT basic JJ guidelines NNS of IN each DT ministry NN and CC agency NN , , standard NN of IN measures NNS of IN each DT ministry NN and CC agency NN , , and CC implementation NN procedure NN of IN each DT ministry NN and CC agency NN in IN this DT order NN . SENT The DT IT PP Security NP Policy NP , , or CC the DT Policy NN , , in IN these DT Guidelines NNS refers VVZ to TO the DT basic JJ guidelines NNS of IN each DT ministry NN and CC agency NN and CC standard NN of IN measures NNS of IN each DT ministry NN and CC agency NN , , and CC does VVZ not RB include VV the DT implementation NN procedure NN of IN each DT ministry NN and CC agency NN . SENT The DT implementation NN procedure NN covers VVZ those DT procedures NNS provided VVN in IN documents NNS , , and CC usage NN regulations NNS some DT earlier JJR documents NNS and CC regulations NNS may MD include VV items NNS about IN the DT standard NN of IN measures NNS concerning VVG information NN systems NNS published VVN thus RB far RB , , as RB well RB as IN those DT newly RB required VVN according VVG to TO the DT policy NN establishment NN this DT time NN for IN example NN , , emergency NN organization NN and CC operation NN of IN the DT monitoring NN system NN . SENT For IN establishing VVG the DT Policy NN from IN the DT high JJ order NN basic JJ guidelines NNS , , the DT existing JJ regulations NNS should MD be VB reviewed VVN . SENT 2 LS . SENT Procedure NN for IN Setting NP up IN the DT Policy NN This DT section NN describes VVZ the DT procedure NN for IN setting VVG up RP the DT Policy NN and CC the DT matters NNS to TO be VB decided VVN for IN the DT Policy NN . SENT 1 CD Outline NN of IN the DT procedure NN As IN shown VVN in IN Fig NN . SENT 3 LS , , the DT Policy NN shall MD be VB set VVN up RP according VVG to TO the DT steps NNS of IN . SENT 1 CD establishing VVG the DT organization NN and CC system NN for IN setting VVG up RP the DT Policy NN , , 2 CD mapping NN the DT basic JJ guidelines NNS under IN such PDT an DT organization NN and CC system NN , , 3 CD analyzing VVG the DT risks NNS , , 4 CD formulating VVG the DT standard NN of IN measures NNS , , and CC 5 CD adopting VVG the DT Policy NN formally RB in IN each DT ministry NN and CC agency NN . SENT Each DT ministry NN and CC agency NN shall MD 6 CD formulate VV an DT implementation NN procedure NN to TO rationalize VV the DT matters NNS set VVN forth RB in IN the DT standard NN for IN countermeasures NNS based VVN on IN its PP$ specific JJ Policy NN . SENT 2 CD Organization NP and CC system NN for IN setting VVG up RP the DT Policy NN For IN setting VVG up RP the DT Policy NN , , an DT organization NN needs VVZ to TO be VB established VVN that WDT is VBZ formed VVN by IN chiefs NNS of IN concerned JJ departments NNS and CC bureaus NNS , , administrators NNS of IN information NN systems NNS , , persons NNS who WP have VHP technical JJ knowledge NN and CC expertise NN about IN IT PP security NN and CC other JJ people NNS . SENT By IN establishing VVG this DT organization NN hereafter RB called VVD the DT IT PP Security NP Committee NP in IN these DT Guidelines NNS , , the DT commitment NN of IN the DT organization NN executives NNS to TO policy NN making NN and CC the DT responsibility NN of IN each DT member NN are VBP made VVN clear JJ . SENT To TO attain VV this DT object NN , , the DT purposes NNS , , authorities NNS , , name NN , , operation NN , , members NNS , , etc FW . SENT of IN the DT IT PP Security NP Committee NP shall MD be VB defined VVN in IN the DT Policy NN . SENT Although IN it PP is VBZ considered VVN that IN the DT concerned JJ persons NNS in IN all DT departments NNS and CC bureaus NNS will MD take VV part NN in IN the DT Policy NN , , because IN it PP deals VVZ with IN various JJ issues NNS about IN information NN , , the DT key JJ members NNS of IN the DT Committee NP should MD include VV the DT following VVG persons NNS concerned VVN . SENT Persons NNS in IN information NN system NN related VVN sections NNS such JJ as IN LAN NP management NN sections NNS Technical NP experts NNS experts NNS with IN technical JJ knowledge NN inside IN and CC outside IN the DT Government NP Persons NP in IN audit NN related JJ sections NNS such JJ as IN sections NNS conducting VVG policy NN evaluation NN , , internal JJ audit NN and CC general JJ affairs NNS section NN of IN secretariat NN Persons NP in IN document NN related JJ sections NNS Persons NP in IN personnel NNS related VVN sections NNS Persons NP in IN accounting VVG related JJ sections NNS Persons NP in IN public JJ relations NNS related VVD sections NNS Persons NP in IN government NN building VVG management NN sections NNS In IN the DT course NN of IN setting VVG up RP the DT Policy NN , , candidates NNS for IN IT PP security NN personnel NNS in IN each DT department NN and CC section NN should MD be VB incorporated VVN into IN the DT organization NN . SENT In IN addition NN , , it PP is VBZ important JJ that IN an DT environment NN should MD be VB created VVN which WDT enables VVZ the DT Policy NN to TO be VB understood VVN by IN the DT staff NN , , by IN hearing VVG their PP$ opinions NNS and CC explaining VVG problems NNS to TO them PP appropriately RB . SENT Some DT of IN the DT Policy NN formulating VVG work NN can MD be VB consigned VVN to TO a DT subordinate JJ group NN Policy NN formulating VVG group NN with IN the DT approval NN of IN the DT IT PP Security NP Committee NP . SENT In IN the DT case NN of IN need NN , , outside JJ people NNS can MD join VV the DT group NN . SENT For IN easy JJ operation NN of IN the DT Policy NN formulating VVG group NN , , the DT executives NNS should MD organize VV the DT group NN formally RB , , using VVG official JJ appointments NNS , , so RB that IN the DT people NNS of IN the DT ministries NNS and CC agencies NNS can MD recognize VV that IN the DT work NN of IN the DT group NN is VBZ based VVN on IN an DT order NN of IN the DT executives NNS . SENT Example NN Information NP Security NP Committee NP This NP Committee NP is VBZ formed VVN by IN representatives NNS of IN the DT following VVG organizations NNS . SENT Chairman NP Chief NP secretary NN Information NP System NP Section NP General NP Affairs NPS Section NP of IN Secretariat NN Documentation NN Section NN of IN Secretariat NN Secretary NP Section NP Accounting NP Section NP Public NP Relations NPS Section NP Miscellaneous JJ duties NNS of IN the DT Committee NP are VBP assumed VVN by IN the DT Information NP System NP Section NP . SENT In IN addition NN , , as IN the DT persons NNS who WP represent VVP the DT interests NNS of IN each DT department NN and CC bureau NN , , staff NN of IN the DT section NN of IN each DT bureau NN , , and CC the DT section NN in IN charge NN of IN the DT A NP system NN A DT Section NN , , shall MD participate VV in IN formulating VVG the DT tasks NNS of IN the DT Policy NN . SENT Staff NN of IN the DT Policy NN Formulating VVG Work NP Group NP Work NP Group NP on IN IT PP security NN policy NN shall MD coordinate VV with IN the DT various JJ departments NNS and CC bureaus NNS in IN the DT ministries NNS and CC agencies NNS , , and CC promote VV an DT understanding NN of IN the DT Policy NN among IN those DT departments NNS and CC bureaus NNS . SENT 3 CD Mapping NN the DT basic JJ guidelines NNS It PP is VBZ required VVN as IN the DT basic JJ guidelines NNS that IN the DT formulation NN of IN the DT basic JJ policies NNS should MD take VV countermeasures NNS to TO guarantee VV the DT IT PP security NN of IN the DT information NN system NN of IN the DT ministry NN and CC agency NN . SENT These DT basic JJ guidelines NNS shall MD indicate VV each DT ministry NN and CC agency's JJ basic JJ concepts NNS for IN IT PP security NN , , including VVG the DT purpose NN , , target NN , , etc FW . SENT of IN the DT IT PP security NN measures NNS . SENT It PP also RB includes VVZ the DT definitions NNS of IN terminology NN required VVN to TO understand VV the DT Policy NN . SENT Note NN that IN the DT basic JJ guidelines NNS should MD not RB be VB updated VVN frequently RB because IN they PP determine VVP the DT basic JJ direction NN concerning VVG IT PP security NN . SENT 4 CD Analyzing VVG the DT risk NN 1 CD General NP Identifying VVG the DT information NN assets NNS to TO be VB protected VVN , , and CC evaluating VVG the DT risk NN to TO those DT assets NNS , , is VBZ called VVN risk NN analysis NN . SENT Although IN there EX are VBP various JJ methods NNS for IN risk NN analysis NN , , we PP would MD like VV to TO outline VV the DT following VVG procedure NN for IN specific JJ risk NN analysis NN that WDT is VBZ our PP$ concern NN . SENT a DT Look NN over IN the DT information NN assets NNS held VVN by IN each DT ministry NN and CC agency NN , , classify VV them PP by IN importance NN and CC determine VV the DT level NN of IN required JJ security NN for IN each DT asset NN . SENT b SYM Investigate VV the DT threats NNS surrounding VVG the DT information NN assets NNS of IN each DT ministry NN and CC agency NN , , determine VV the DT scale NN of IN the DT risk NN , , based VVN on IN the DT frequency NN of IN threat NN occurrence NN , , and CC the DT amount NN of IN damage NN caused VVN by IN the DT threat NN . SENT Note NN that IN the DT scale NN of IN risk NN generally RB refers VVZ to TO the DT product NN of IN frequency NN of IN threat NN occurrence NN , , and CC the DT amount NN of IN damage NN caused VVN by IN the DT threat NN . SENT c SYM Formulate VV the DT standard JJ countermeasures NNS so RB that IN the DT scale NN of IN risk NN falls VVZ below IN the DT level NN of IN required JJ security NN , , and CC implement VV risk NN management NN as IN appropriate JJ . SENT When WRB changes NNS are VBP made VVN to TO the DT information NN assets NNS , , or CC if IN the DT risk NN to TO the DT information NN assets NNS is VBZ varied VVN , , risk NN analysis NN is VBZ made VVN again RB for IN the DT relevant JJ information NN assets NNS , , and CC the DT Policy NN is VBZ reviewed VVN as IN required VVN . SENT Also RB in IN respect NN to TO regular JJ review NN of IN the DT Policy NP , , the DT work NN should MD begin VV with IN risk NN analysis NN . SENT In IN addition NN , , if IN vulnerability NN is VBZ found VVN in IN any DT information NN assets NNS , , action NN should MD be VB promptly RB taken VVN if IN necessary JJ . SENT Although IN the DT materials NNS describing VVG the DT results NNS of IN risk NN analysis NN shall MD be VB saved VVN as IN the DT basic JJ materials NNS for IN setting VVG up RP the DT Policy NN , , their PP$ saving NN should MD be VB placed VVN under IN strict JJ management NN because IN they PP contain VVP analysis NN of IN system NN vulnerability NN . SENT 2 CD Inquiry NP to TO information NN assets NNS To TO identify VV the DT information NN assets NNS to TO be VB protected VVN , , inquiries NNS should MD be VB made VVN as RB to TO where WRB the DT assets NNS are VBP located VVN , , by IN whom WP they PP are VBP managed VVN , , and CC how WRB they PP are VBP dealt VVN with IN . SENT The DT following NN is VBZ an DT example NN of IN a DT questionnaire NN showing VVG specific JJ inquiry NN items NNS . SENT Besides IN such PDT a DT questionnaire NN , , materials NNS that WDT describe VVP the DT results NNS of IN risk NN analysis NN should MD also RB be VB prepared VVN . SENT Example NN Questionnaire NN concerning VVG information NN assets NNS Inventory NN concerning VVG information NN assets NNS Name NN of IN information NN asset NN Use NP Administrator NP User NP access NN right NN Place NN of IN saved VVN installation NN Term NN of IN saved VVN installation NN Importance NN I PP , , II NP , , III NP , , IV NP Confidentiality NN I NN , , II NP , , III NP , , IV NP Integrity NN I NN , , II NP , , III NP , , IV NP Availability NN I NN , , II NP , , III NP , , IV NP 3 CD Classification NN by IN importance NN The DT inquired VVD information NN assets NNS are VBP examined VVN for IN classification NN in IN terms NNS of IN three CD aspects NNS of IN importance NN , , or CC confidentiality NN , , integrity NN and CC availability NN . SENT This DT classification NN provides VVZ the DT standard NN for IN deciding VVG how WRB each DT information NN asset NN is VBZ handled VVN and CC protected VVN . SENT The DT level NN of IN required JJ security NN for IN each DT information NN asset NN is VBZ determined VVN by IN this DT standard NN . SENT Three CD aspects NNS of IN importance NN a DT Confidentiality NN . SENT Importance NN based VVN on IN the DT secret NN contained VVN in IN the DT information NN asset NN b SYM Integrity NN . SENT Importance NN concerning VVG the DT integrity NN and CC accuracy NN of IN the DT information NN asset NN c SYM Availability NN . SENT Importance NN concerning VVG the DT availability NN and CC continuity NN of IN the DT information NN asset NN Example NN Degree NP of IN importance NN Violation NN of IN security NN exerts VVZ a DT serious JJ influence NN on IN the DT life NN , , property NN , , and CC privacy NN of IN the DT nation NN . SENT Violation NN of IN security NN exerts VVZ a DT serious JJ influence NN as RB to TO the DT execution NN of IN administrative JJ affairs NNS . SENT Violation NN of IN security NN exerts VVZ a DT slight JJ influence NN on IN the DT execution NN of IN administrative JJ affairs NNS . SENT Violation NN of IN security NN exerts VVZ little JJ influence NN . SENT Example NN The DT level NN of IN required JJ security NN based VVN on IN the DT importance NN of IN information NN assets NNS The DT level NN is VBZ set VVN considering VVG the DT three CD aspects NNS of IN the DT importance NN mentioned VVN above IN . SENT Importance NN I NN Level NP 1 CD of IN required JJ security NN Importance NN II NP Level NP 2 CD of IN required JJ security NN Importance NN III NP Level NP 3 CD of IN required JJ security NN Importance NN IV NP Level NP 4 CD of IN required VVN security NN 4 CD Risk NN assessment NN Risk NN assessment NN shall MD be VB performed VVN for IN all DT inquiries NNS as RB to TO information NN assets NNS . SENT a DT Investigations NNS shall MD be VB made VVN into IN threats NNS in IN the DT surrounding VVG physical JJ , , technical JJ , , and CC human JJ environments NNS . SENT Examples NNS of IN threats NNS Physical JJ threats NNS . SENT intrusion NN , , destruction NN , , failure NN , , power NN stoppage NN , , disaster NN , , etc FW . SENT Technical JJ threats NNS . SENT unauthorized JJ access NN , , tapping VVG , , computer NN virus NN , , tampering VVG , , deletion NN , , DoS NNS attack VVP , , disguise VV , , etc FW . SENT Human JJ threats NNS . SENT abusing VVG extraction NN , , misconduct NN , , inappropriate JJ management NN of IN passwords NNS , , etc FW . SENT b SYM Magnitude NN of IN risks NNS to TO the DT threats NNS that IN each DT information NN asset NN is VBZ facing VVG shall MD be VB assessed VVN from IN a DT frequency NN of IN the DT threats NNS and CC b LS scale NN of IN damage NN when WRB a DT threat NN occurs VVZ . SENT Instead RB of IN directly RB examining VVG the DT frequency NN of IN the DT threats NNS and CC the DT scale NN of IN damage NN , , the DT vulnerability NN of IN information NN assets NNS taken VVN for IN frequency NN and CC the DT importance NN of IN information NN assets NNS taken VVN for IN scale NN of IN damage NN can MD be VB examined VVN for IN convenience NN . SENT The DT magnitude NN of IN risk NN shall MD be VB examined VVN with IN all DT threats NNS to TO each DT information NN asset NN . SENT Example NN Assessment NP levels NNS set VVN in IN phase NN of IN frequency NN and CC scale NN of IN damage NN a DT Frequency NN of IN the DT threat NN A DT . SENT The DT threat NN occurs VVZ at IN a DT considerable JJ frequency NN . SENT The DT vulnerability NN is VBZ very RB serious JJ . SENT B LS . SENT The DT threat NN occurs VVZ at IN times NNS . SENT The DT vulnerability NN is VBZ serious JJ . SENT C LS . SENT The DT threat NN occurs VVZ incidentally RB . SENT The DT vulnerability NN is VBZ slight JJ . SENT D SYM . SENT The DT threat NN occurs VVZ scarcely RB . SENT There EX is VBZ little JJ vulnerability NN . SENT b SYM Scale NP of IN damage NN when WRB the DT threat NN is VBZ realized VVN . SENT There EX is VBZ a DT method NN that WDT approximates VVZ the DT scale NN of IN damage NN to TO the DT ranking NN of IN importance NN . SENT This DT method NN assumes VVZ that IN the DT higher JJR the DT importance NN is VBZ , , the DT greater JJR the DT damage NN becomes VVZ . SENT To TO determine VV the DT scale NN of IN damage NN strictly RB by IN this DT method NN , , the DT three CD aspects NNS of IN importance NN shall MD be VB taken VVN into IN consideration NN . SENT Scale NN of IN damage NN a DT . SENT The DT same JJ as IN importance NN I PP . SENT b LS . SENT The DT same JJ as IN importance NN II NP . SENT c SYM . SENT The DT same JJ as IN importance NN III NP . SENT d SYM . SENT The DT same JJ as IN importance NN IV NP . SENT 5 CD Countermeasures NNS against IN risks NNS The DT scale NN of IN the DT risk NN for IN each DT threat NN to TO an DT information NN asset NN evaluated VVN by IN the DT risk NN assessment NN is VBZ compared VVN with IN the DT level NN of IN required JJ security NN for IN the DT standard NN of IN IT PP security NN measures NNS . SENT When WRB the DT standard NN of IN IT PP security NN measures NNS is VBZ determined VVN , , it PP should MD aim VV at IN satisfying VVG the DT level NN of IN required JJ security NN by IN reducing VVG the DT frequency NN of IN threat NN and CC the DT scale NN of IN damage NN . SENT The DT measures NNS to TO reduce VV the DT frequency NN of IN threat NN and CC the DT scale NN of IN damage NN should MD include VV those DT that WDT prevent VVP threats NNS . SENT The DT measures NNS should MD also RB include VV procedures NNS that WDT guard VVP the DT information NN , , keep VV the DT information NN from IN tampering VVG , , and CC enable VV the DT information NN to TO be VB used VVN continuously RB , , when WRB damage NN actually RB occurred VVD . SENT In IN addition NN , , prompt JJ recovery NN in IN the DT case NN of IN a DT fault NN should MD be VB taken VVN into IN consideration NN . SENT In IN formulating VVG measures NNS to TO attain VV the DT level NN of IN required JJ security NN considering VVG the DT importance NN of IN information NN assets NNS , , it PP is VBZ noted VVN that IN the DT frequency NN of IN threats NNS should MD become VV lower JJR , , and CC the DT damage NN or CC the DT risk NN should MD become VV smaller JJR , , as IN the DT level NN of IN required JJ security NN becomes VVZ higher JJR . SENT For IN example NN , , the DT methods NNS of IN reducing VVG the DT scale NN of IN the DT risk NN to TO the DT level NN of IN required JJ security NN are VBP divided VVN into IN the DT following VVG three CD types NNS . SENT a DT Method NN to TO reduce VV the DT scale NN of IN the DT risk NN by IN reducing VVG the DT scale NN of IN the DT damage NN , , for IN example NN , , by IN granting VVG access NN rights NNS only RB to TO those DT who WP need VVP to TO access VV the DT information NN . SENT b SYM Method NN to TO reduce VV the DT scale NN of IN the DT risk NN by IN reducing VVG the DT scale NN of IN the DT damage NN , , for IN example NN , , by IN granting VVG access NN rights NNS only RB to TO those DT who WP need VVP to TO access VV the DT information NN . SENT c SYM Method NN to TO reduce VV the DT scale NN of IN the DT risk NN by IN reducing VVG both CC the DT scale NN of IN damage NN and CC the DT frequency NN of IN threats NNS , , for IN example NN , , by IN detecting VVG tampering VVG of IN information NN systems NNS . SENT The DT measures VVZ to TO be VB determined VVN specifically RB should MD be VB effective JJ and CC efficient JJ , , paying VVG due JJ consideration NN to TO the DT convenience NN of IN users NNS , , according VVG to TO information NN assets NNS and CC their PP$ threats NNS . SENT Example NN Examining VVG the DT standard NN of IN measures NNS unauthorized JJ access NN Results NNS of IN risk NN assessment NN Frequency NN of IN occurrence NN B NP , , scale NN of IN damage NN a DT The DT standard NN of IN measures NNS are VBP examined VVN to TO reduce VV the DT risk NN of IN unauthorized JJ access NN Granting VVG access NN rights NNS only RB to TO those DT who WP need VVP to TO access VV the DT information NN Permitting VVG logins NP from IN the DT console VV only RB Introducing VVG correction NN programs NNS patches VVZ Monitoring VVG and CC recording VVG access NN logs NNS Detecting VVG tampering VVG of IN information NN systems NNS Protecting VVG information NN assets NNS by IN emergency NN action NN Reduce VV of IN risk NN Frequency NN of IN occurrence NN C NP , , scale NN of IN damage NN c NN 5 CD Formulating VVG the DT standard NN of IN measures NNS Individual JJ measures NNS for IN each DT information NN asset NN , , which WDT are VBP obtained VVN as IN the DT result NN of IN risk NN assessment NN , , should MD be VB organized VVN to TO formulate VV the DT standard NN of IN measures NNS . SENT 1 CD Configuration NN The DT standard NN of IN measures NNS should MD be VB configured VVN as RB follows VVZ . SENT i NP Organization NP and CC system NN ii NN Classification NN and CC management NN of IN information NN a DT Management NP responsibilities NNS for IN information NN b NN Classification NN and CC management NN of IN information NN iii NNS Physical JJ security NN iv NP Human NP security NN a DT Role NN , , responsibility NN , , and CC exemption NN b NN Education NN and CC training NN c NN Reporting NP of IN incidents NNS and CC defects NNS d SYM Management NN of IN authentication NN information NN , , etc FW . SENT for IN access NN e NN Employment NN of IN part NN time NN and CC temporary JJ staff NN , , and CC their PP$ employment NN agreement NN v NN Technical JJ security NN a DT Management NN of IN computers NNS and CC networks NNS b SYM Access NP control NN c SYM Development NP , , implementation NN and CC maintenance NN of IN systems NNS d SYM Countermeasures NNS against IN computer NN viruses NNS e NN Collection NN of IN security NN information NN vi NP Operation NN a DT Monitoring NN of IN information NN systems NNS and CC making VVG sure JJ of IN policy NN observation NN operation NN management NN b SYM Considerations NNS in IN operation NN management NN c SYM Contingency NN plan NN d SYM Operation NN agreement NN for IN consignment NN to TO outside JJ contractors NNS vii NN Compliance NN of IN laws NNS viii NP Action NP against IN violation NN of IN IT PP security NN policy NN ix NN Evaluation NN and CC review VV 2 CD Organization NP and CC system NN For IN the DT organization NN and CC system NN to TO maintain VV IT PP security NN , , it PP is VBZ important JJ that IN executives NNS should MD take VV initiative NN in IN promoting VVG the DT protection NN of IN IT PP security NN . SENT To TO realize VV this DT purpose NN , , it PP is VBZ required VVN that IN the DT person NN who WP takes VVZ the DT final JJ responsibility NN for IN IT PP security NN Chief NP IT PP Security NP Officer NP . SENT CISO NP 7 CD 5 CD is VBZ selected VVN and CC his PP$ her PP$ responsibility NN and CC authority NN are VBP made VVN clear JJ . SENT Specifically RB , , the DT IT PP Security NP Committee NP , , headed VVN by IN the DT CISO NP , , should MD assume VV the DT responsibilities NNS for IN establishing VVG a DT system NN that WDT ensures VVZ the DT observation NN of IN Policy NN on IN a DT daily JJ basis NN , , investigating VVG and CC reviewing VVG the DT improvements NNS gaps NNS from IN the DT real JJ world NN at IN the DT time NN of IN implementation NN and CC carrying VVG out RP of IN education NN activities NNS . SENT The DT Policy NN defines VVZ the DT purposes NNS , , duties NNS , , authorities NNS , , etc FW . SENT of IN the DT CISO NP and CC the DT IT PP Security NP Committee NP as RB well RB as IN the DT establishment NN of IN members NNS , , the DT secretariat NN and CC the DT Audit NP Group NP , , etc FW . SENT The DT Policy NN also RB provides VVZ for IN the DT systems NNS and CC authority NN that IN the DT secretariat NN and CC the DT Audit NP Group NP should MD have VH so RB that IN the DT duties NNS of IN the DT Committee NP are VBP surely RB performed VVN . SENT In IN particular JJ , , regarding VVG the DT system NN for IN making VVG sure JJ of IN policy NN observation NN , , the DT Policy NN provides VVZ the DT duties NNS of IN the DT Audit NP Group NP and CC establishes VVZ a DT system NN in IN which WDT the DT Audit NP Group NP makes VVZ sure JJ of IN the DT implementation NN status NN of IN measures NNS such JJ as IN auditing NN , , budget NN and CC organization NN and CC reports VVZ the DT results NNS to TO the DT Committee NP . SENT 7 CD 5 CD Chief NP IT PP Security NP Officer NP 3 CD Classification NN and CC management NN of IN information NN Methods NNS of IN information NN management NN are VBP decided VVN according VVG to TO the DT classification NN of IN information NN management NN used VVN in IN the DT risk NN analysis NN . SENT i NP Management NP responsibility NN of IN information NN Persons NP who WP bear VVP management NN responsibility NN are VBP determined VVN for IN each DT information NN item NN . SENT The DT responsibilities NNS for IN both CC those DT who WP manage VVP it PP and CC those DT who WP use VVP it PP should MD be VB studied VVN , , and CC the DT responsibilities NNS and CC roles NNS should MD be VB defined VVN for IN each DT . SENT The DT information NN administrator NN , , who WP will MD take VV the DT management NN responsibility NN for IN the DT documents NNS prepared VVN in IN that DT section NN , , should MD be VB formally RB selected VVN for IN each DT section NN . SENT Documents NNS and CC e NN mail NN messages NNS that WDT are VBP being VBG prepared VVN should MD be VB managed VVN properly RB by IN individual JJ persons NNS . SENT Example NN Each DT department NN , , bureau NN , , or CC section NN should MD assume VV managerial JJ responsibility NN , , as IN the DT information NN administrator NN , , for IN any DT information NN it PP prepares VVZ . SENT Information NN prepared VVN by IN Bureau NP A NP General NP affairs NNS section NN of IN Bureau NP A NP Information NP prepared VVD by IN Section NP X NP , , Bureau NP A NP Section NP X NP , , Bureau NP A NP Information NP prepared VVD by IN a DT ministry NN General NP affairs NNS section NN of IN the DT minister's JJ secretariat NN or CC the DT section NN decided VVD as IN the DT information NN administrator NN ii NN Classification NN and CC management NN of IN information NN For IN the DT information NN held VVN by IN the DT ministries NNS and CC agencies NNS , , the DT classification NN and CC management NN are VBP decided VVN , , based VVN on IN the DT results NNS of IN the DT classification NN of IN information NN assets NNS , , provided VVN in IN the DT risk NN analysis NN . SENT Specifically RB , , provisions NNS should MD be VB made VVN , , not RB only RB for IN classification NN of IN information NN and CC indication NN about IN the DT classification NN of IN information NN , , but CC also RB for IN the DT granting VVG of IN access NN rights NNS , , encryption NN , , management NN of IN media NNS , , changing VVG or CC discarding VVG of IN information NN , , effective JJ period NN of IN classification NN , , etc FW . SENT , , as IN methods NNS of IN information NN management NN . SENT If IN information NN that WDT has VHZ been VBN classified VVN is VBZ copied VVN or CC transmitted VVN , , the DT reproduced VVD information NN should MD also RB be VB managed VVN in IN accordance NN with IN its PP$ original JJ classification NN . SENT Example NN A DT Principle NN Whether IN the DT information NN held VVN in IN this DT ministry NN should MD be VB made VVN public JJ or CC not RB is VBZ determined VVN by IN the DT Information NP Disclosure NN Law NP Law NP Concerning VVG Access NP to TO Information NP held VVN by IN Administrative NP Organizations NP . SENT For IN information NN that WDT is VBZ considered VVN improper JJ to TO make VV public JJ , , such JJ as IN information NN concerning VVG the DT privacy NN of IN individuals NNS or CC information NN that WDT may MD create VV a DT problem NN of IN IT PP security NN , , provisions NNS should MD be VB made VVN as IN required VVN . SENT B SYM Indication NN about IN the DT classification NN of IN information NN For IN printed JJ matter NN , , displays NNS on IN monitors NNS , , storage NN media NNS labels NNS for IN FD NN , , etc FW . SENT , , and CC file NN names NNS , , necessary JJ indications NNS of IN their PP$ classification NN should MD be VB made VVN , , paying VVG due JJ consideration NN to TO measures NNS that WDT prevent VVP third JJ parties NNS from IN recognizing VVG the DT importance NN of IN information NN . SENT C NP Management NP of IN information NN determined VVN by IN the DT classification NN a DT Granting VVG of IN access NN rights NNS and CC encryption NN Access NP rights NNS should MD be VB determined VVN by IN the DT classification NN of IN the DT information NN . SENT Information NN that WDT was VBD classified VVN as IN secret NN should MD always RB be VB encrypted VVN and CC saved VVN strictly RB , , separate JJ from IN its PP$ encryption NN key NN . SENT b SYM Management NP of IN media NNS Secret JJ information NN storage NN media NNS FD NN , , MO NN , , CD NP R NP , , DAT NP , , MT NP , , DVD NP RAM NN , , etc FW . SENT should MD be VB saved VVN in IN places NNS that WDT can MD be VB locked VVN . SENT c SYM Management NP of IN information NN change NN or CC discard VV Changing VVG or CC discarding VVG of IN information NN should MD be VB made VVN with IN the DT approval NN of IN the DT information NN administrator NN . SENT The DT history NN data NNS , , including VVG the DT date NN of IN when WRB changed VVN or CC discarded VVN , , the DT name NN of IN the DT person NN in IN charge NN , , the DT contents NNS of IN the DT processing NN should MD be VB held VVN . SENT Deletion NN of IN secret JJ information NN should MD be VB performed VVN by IN a DT method NN that WDT disables VVZ the DT recovery NN of IN deleted VVN information NN reformatting NN of IN the DT medium NN , , for IN example NN . SENT 4 CD Physical JJ security NN To TO protect VV information NN systems NNS and CC places NNS where WRB they PP are VBP installed VVN from IN unauthorized JJ entry NN , , damage NN , , and CC disturbance NN , , physical JJ measures NNS such JJ as IN installation NN of IN proper JJ facilities NNS , , entry NN exit NN management NN , , and CC anti JJ theft NN measures NNS for IN PCs NNS in IN office NN rooms NNS , , should MD be VB decided VVN . SENT To TO prevent VV information NN leakage NN using VVG mobile JJ communication NN devices NNS , , necessary JJ measures NNS should MD be VB studied VVN , , paying VVG consideration NN to TO the DT future JJ proliferation NN of IN such JJ devices NNS . SENT With IN respect NN to TO wireless VV LAN NP , , the DT standards NNS for IN determining VVG the DT propriety NN of IN installation NN should MD be VB established VVN in IN the DT section NN on IN physical JJ security NN , , and CC the DT standards NNS for IN code NN and CC authentication NN in IN the DT case NN of IN allowing VVG installation NN should MD be VB established VVN in IN the DT section NN on IN technical JJ security NN . SENT Example NN For IN network NN devices NNS including VVG computers NNS , , proper JJ physical JJ measures NNS should MD be VB taken VVN in IN accordance NN with IN classification NN of IN importance NN I PP , , II NP , , III NP , , and CC IV NP used VVD in IN risk NN analysis NN . SENT Use NN of IN double JJ keys NNS and CC IC NP authentication NN cards NNS , , installation NN of IN monitor NN cameras NNS and CC antimagnetic JJ walls NNS , , thorough JJ management NN of IN entry NN exit NN , , installation NN of IN fire NN extinguishing VVG facilities NNS and CC protection NN of IN wiring NN securing VVG devices NNS by IN chains NNS , , and CC protection NN of IN wiring NN . SENT . SENT . SENT These DT devices NNS should MD be VB properly RB managed VVN by IN the DT section NN in IN charge NN . SENT 5 CD Human JJ security NN Increase VV of IN IT PP security NN does VVZ not RB always RB go VV together RB with IN an DT increase NN of IN convenience NN , , and CC may MD not RB be VB easily RB understood VVN by IN users NNS . SENT This DT requires VVZ that IN necessary JJ measures NNS should MD be VB decided VVN for IN human JJ security NN , , so RB that IN adequate JJ education NN can MD be VB provided VVN . SENT i NP Role NN , , responsibility NN , , and CC exemption NN As IN a DT part NN of IN the DT target NN of IN application NN decided VVN in IN the DT basic JJ guidelines NNS , , the DT role NN and CC responsibility NN of IN each DT person NN being VBG targeted VVN , , who WP assumes VVZ the DT responsibility NN and CC role NN of IN the DT executives NNS and CC staff NN should MD be VB determined VVN together RB with IN their PP$ relationship NN to TO outside JJ contractors NNS including VVG the DT relationship NN to TO program NN developers NNS . SENT For IN exemption NN , , necessary JJ provisions NNS for IN smooth JJ application NN of IN the DT Policy NN should MD be VB determined VVN , , including VVG the DT clause NN , , that IN the DT responsibility NN for IN IT PP security NN failure NN will MD be VB discharged VVN , , if IN the DT person NN in IN charge NN notifies VVZ of IN failure NN on IN his PP$ or CC her PP$ initiative NN . SENT a DT Chief NP IT PP Security NP Officer NP CISO NP The NP CISO NP should MD assume VV authority NN and CC responsibility NN for IN IT PP security NN as IN a DT whole NN . SENT It PP should MD also RB have VH the DT decision NN authority NN concerning VVG important JJ matters NNS on IN operation NN . SENT b SYM Officers NNS in IN charge NN of IN IT PP security NN executives NNS and CC other JJ leaders NNS IT PP security NN officers NNS should MD be VB selected VVN in IN each DT section NN , , department NN and CC bureau NN . SENT Their PP$ duties NNS and CC responsibilities NNS should MD include VV formulating VVG a DT line NN of IN command NN in IN their PP$ organizations NNS , , and CC collecting VVG and CC processing VVG opinions NNS of IN their PP$ people NNS . SENT For IN example NN , , personnel NNS in IN each DT section NN should MD report VV a DT violation NN against IN or CC a DT problem NN with IN the DT Policy NN to TO the DT officer NN in IN charge NN of IN IT PP security NN for IN advice NN or CC direction NN . SENT The DT officer NN in IN charge NN should MD decide VV whether IN a DT violation NN or CC problem NN should MD be VB reported VVN to TO CISO NP . SENT c SYM System NP management NN structure NN With IN respect NN to TO the DT system NN management NN structure NN that WDT plays VVZ an DT important JJ role NN in IN IT PP security NN measures NNS , , the DT structure NN , , responsibilities NNS and CC authority NN thereof RB should MD be VB provided VVN . SENT A DT System NP administrator NN The DT allocation NN of IN the DT system NN administrator NN , , who WP carries VVZ out IN maintenance NN , , management NN and CC operation NN of IN an DT information NN system NN , , should MD be VB determined VVN , , and CC the DT duties NNS for IN IT PP security NN , , such JJ as IN policy NN observation NN , , should MD be VB clarified VVN with IN respect NN to TO the DT information NN system NN managed VVN by IN the DT system NN administrator NN . SENT In IN addition NN , , measures NNS necessary JJ for IN policy NN observation NN should MD be VB taken VVN , , such JJ as IN regulating VVG the DT implementation NN procedures NNS for IN the DT information NN system NN managed VVN by IN the DT system NN administrator NN . SENT It PP should MD also RB be VB provided VVN that IN the DT system NN administrator NN may MD exercise VV necessary JJ authority NN within IN the DT scope NN of IN the DT Policy NN , , regardless RB of IN departments NNS and CC bureaus NNS . SENT B NP System NP administration NN staff NN The DT allocation NN of IN the DT administration NN staff NN sufficient JJ to TO appropriately RB implement VV IT PP security NN measures NNS should MD be VB determined VVN . SENT The DT system NN administration NN staff NN shall MD carry VV out RP system NN management NN work NN in IN line NN with IN the DT system NN administrator's NN orders NNS . SENT d SYM Staff NP and CC other JJ personnel NNS Obligation NN to TO observe VV the DT IT PP security NN measures VVZ A DT provision NN should MD be VB set VVN forth RB that IN places NNS the DT staff NN under IN an DT obligation NN to TO observe VV the DT contents NNS of IN the DT Policy NP and CC the DT implementation NN procedure NN , , individual JJ manuals NNS will MD do VV in IN order NN to TO have VH the DT IT PP security NN measures NNS function VVP effectively RB . SENT The DT staff NN is VBZ also RB required VVN to TO give VV advice NN when WRB he PP she PP has VHZ questions NNS or CC opinions NNS about IN the DT Policy NN . SENT Management NN concerning VVG external JJ consignment NN When WRB the DT ministries NNS and CC agencies NNS consign VV development NN and CC operation NN management NN of IN information NN systems NNS to TO outside JJ contractors NNS including VVG subcontractors NNS , , it PP is VBZ recognized VVN that IN the DT obligation NN to TO observe VV the DT Policy NN and CC the DT implementation NN procedure NN is VBZ imposed VVN on IN those DT contractors NNS according VVG to TO the DT target NN of IN application NN . SENT Provisions NNS are VBP thus RB required VVN to TO have VH the DT contractors NNS observe VVP the DT Policy NN and CC the DT implementation NN procedure NN , , to TO provide VV education NN for IN this DT purpose NN , , and CC to TO include VV a DT damage NN compensation NN clause NN to TO the DT contracts NNS in IN cases NNS where WRB the DT Policy NN or CC procedure NN is VBZ not RB observed VVN . SENT Because IN the DT contractors NNS may MD deal VV with IN important JJ information NN in IN terms NNS of IN security NN , , they PP should MD pay VV due JJ consideration NN to TO the DT technical JJ abilities NNS and CC credibility NN of IN their PP$ personnel NNS who WP handle VVP such JJ information NN . SENT Incidentally RB , , regarding VVG agreements NNS for IN consignment NN to TO outside JJ contractors NNS , , 6 CD iii NP Development NP , , implementation NN and CC maintenance NN of IN systems NNS and CC 7 CD iv NN Operation NN agreement NN for IN consignment NN to TO outside JJ contractors NNS shall MD also RB be VB taken VVN into IN consideration NN Part NN time NN and CC temporary JJ workers NNS It PP is VBZ prescribed VVN that IN part NN time NN and CC temporary JJ workers NNS should MD assume VV responsibility NN and CC a DT role NN in IN the DT manner NN that WDT is VBZ applied VVN to TO other JJ staff NN members NNS . SENT Miscellaneous JJ It PP should MD be VB noted VVN that IN when WRB staff NN or CC part NN time NN and CC temporary JJ workers NNS who WP work VVP for IN IT PP security NN leave VV the DT work NN because IN of IN personnel NNS changes NNS or CC retirement NN , , the DT information NN known VVN to TO the DT staff NN or CC other JJ workers NNS poses VVZ a DT security NN problem NN . SENT ii NP Education NP and CC training NN Part NN of IN implementation NN of IN the DT Policy NN may MD be VB realized VVN automatically RB by IN technical JJ actions NNS incorporated VVN in IN information NN systems NNS . SENT A DT greater JJR portion NN of IN implementation NN , , however RB , , depends VVZ on IN the DT decision NN and CC activities NNS of IN the DT persons NNS in IN charge NN and CC users NNS in IN the DT organization NN . SENT Thus RB to TO raise VV and CC maintain VV security NN consciousness NN , , education NN and CC training NN should MD be VB provided VVN , , based VVN on IN a DT plan NN so RB that IN all DT people NNS in IN the DT organization NN , , including VVG the DT executives NNS , , recognize VVP the DT importance NN of IN IT PP security NN , , and CC understand VV and CC carry VV out RP the DT Policy NN . SENT Education NN and CC training NN are VBP important JJ to TO protect VV information NN systems NNS against IN unauthorized JJ accesses NNS , , computer NN viruses NNS , , information NN leakage NN by IN insiders NNS , , attacks NNS from IN the DT outside NN , , etc FW . SENT Specifically RB , , research NN study NN meetings NNS , , seminars NNS , , and CC other JJ educational JJ activities NNS should MD be VB provided VVN . SENT Training NN programs NNS for IN new JJ employees NNS should MD also RB be VB provided VVN . SENT iii NP Reporting NP of IN incidents NNS and CC defects NNS If IN a DT member NN of IN the DT staff NN becomes VVZ aware JJ of IN an DT incident NN concerning VVG IT PP security NN or CC a DT defect NN of IN an DT information NN system NN , , s PP he PP should MD promptly RB report VV it PP to TO the DT IT PP security NN officer NN , , in IN order NN to TO receive VV directions NNS , , without IN attempting VVG to TO solve VV the DT incident NN or CC defect VV themselves PP . SENT A DT provision NN should MD be VB made VVN , , concerning VVG the DT obligation NN to TO report VV incidents NNS and CC defects NNS and CC reporting VVG method NN , , to TO localize VV the DT damage NN of IN an DT incident NN or CC defect NN . SENT In IN addition NN , , with IN the DT implementation NN of IN electronic JJ application NN , , notification NN , , etc FW . SENT , , there EX will MD be VB more JJR opportunities NNS for IN the DT public NN to TO exchange VV important JJ information NN by IN using VVG the DT government's JJ information NN system NN . SENT Therefore RB , , the DT necessary JJ standards NNS should MD be VB established VVN to TO appropriately RB receive VV and CC deal VV with IN reports NNS and CC communications NNS about IN incidents NNS and CC defects NNS from IN the DT public NN . SENT iv NP Management NP of IN authentication NN information NN , , etc FW . SENT for IN access NN Authentication NN information NN for IN access NN to TO an DT information NN system NN ID NN , , password NN , , information NN relating VVG to TO biometric JJ authentication NN , , etc FW . SENT and CC media NNS recording VVG such JJ information NN IC NP card NN , , etc FW . SENT referred VVN to TO as IN authentication NN information NN , , etc FW . SENT hereafter RB is VBZ information NN liable JJ to TO be VB infringed VVN due RB to TO human JJ security NN factors NNS . SENT The DT standards NNS should MD be VB set VVN to TO minimize VV the DT risk NN of IN leakage NN due JJ to TO human JJ factors NNS in IN the DT process NN from IN issue NN of IN authentication NN information NN , , etc FW . SENT by IN the DT administrator NN to TO the DT management NN thereof RB by IN users NNS . SENT Specifically RB , , the DT standards NNS for IN management NN of IN authentication NN information NN , , etc FW . SENT by IN users NNS should MD be VB established VVN . SENT In IN particular JJ , , since IN IDs NNS and CC passwords NNS are VBP information NN likely JJ to TO be VB leaked VVN , , a DT method NN of IN management NN thereof RB by IN users NNS should MD be VB defined VVN clearly RB and CC IDs NNS and CC passwords NNS should MD be VB effectively RB coordinated VVN with IN technical JJ security NN items NNS that WDT complement VV them PP , , for IN example NN , , restriction NN of IN passwords NNS by IN the DT number NN of IN letters NNS , , etc FW . SENT based VVN on IN the DT access NN control NN function NN . SENT Example NN 1 CD Password NN management NN The DT password NN should MD be VB kept VVN secret JJ . SENT Notes NNS on IN passwords NNS should MD not RB be VB taken VVN unless IN the DT notes NNS are VBP saved VVN securely RB . SENT If IN an DT information NN system NN or CC passwords NNS might MD be VB exposed VVN to TO risk VV , , the DT passwords NNS should MD be VB changed VVN . SENT The DT password NN should MD be VB of IN a DT proper JJ length NN , , and CC the DT character NN string NN should MD be VB a DT one NN that IN cannot NN be VB easily RB associated VVN . SENT Details NNS are VBP decided VVN in IN the DT implementation NN procedure NN . SENT Each DT password NN should MD be VB changed VVN when WRB a DT predetermined VVN period NN has VHZ elapsed VVN or CC when WRB the DT predetermined VVN number NN of IN accesses NNS is VBZ reached VVN old JJ password NN should MD not RB be VB used VVN . SENT The DT password NN for IN the DT administrator NN should MD be VB changed VVN more RBR frequently RB . SENT Users NNS should MD not RB have VH their PP$ passwords NNS used VVN by IN other JJ users NNS . SENT Passwords NNS should MD not RB be VB stored VVN in IN mobile JJ communication NN devices NNS . SENT 2 CD IC NP card NN management NN Users NNS must MD observe VV the DT following VVG matters NNS with IN respect NN to TO IC NP cards NNS for IN authentication NN . SENT Users NNS should MD strictly RB manage VV the DT IC NP cards NNS for IN authentication NN . SENT If IN users NNS have VHP lost VVN the DT IC NP cards NNS , , they PP should MD immediately RB notify VV the DT system NN administrator NN of IN such JJ . SENT Users NNS should MD observe VV other JJ matters NNS prescribed VVN by IN the DT system NN administrator NN relating VVG to TO use VV of IN the DT IC NP cards NNS for IN authentication NN . SENT v NN Employment NN of IN part NN time NN and CC temporary JJ staff NN and CC their PP$ employment NN agreement NN It PP is VBZ required VVN to TO have VH part NN time NN and CC temporary JJ staff NN understand VV the DT observance NN of IN the DT Policy NN clearly RB in IN terms NNS of IN IT PP security NN . SENT In IN particular JJ , , when WRB they PP need VVP to TO work VV with IN PCs NNS , , the DT access NN management NN of IN those DT PCs NNS and CC their PP$ authority NN to TO the DT information NN system NN , , should MD be VB defined VVN clearly RB to TO prevent VV unauthorized JJ access NN by IN the DT staff NN . SENT Therefore RB , , provisions NNS should MD be VB set VVN forth RB that IN , , for IN example NN , , the DT Policy NN is VBZ made VVN known VVN to TO the DT part NN time NN and CC temporary JJ staff NN and CC the DT staff NN sign VV a DT written JJ consent NN . SENT 6 CD Technical NP security NN i NP Management NP of IN computers NNS and CC networks NNS Considerations NNS and CC regulations NNS should MD be VB set VVN forth RB concerning VVG the DT operation NN management NN procedures NNS of IN information NN systems NNS , , network NN management NN , , protection NN of IN storage NN media NNS , , data NNS exchange NN with IN other JJ organizations NNS . SENT Methods NNS of IN handling VVG and CC managing VVG devices NNS should MD also RB be VB determined VVN based VVN on IN the DT results NNS of IN risk NN analysis NN . SENT Example NN Information NN should MD be VB managed VVN as RB follows VVZ according VVG to TO the DT classification NN of IN information NN assets NNS . SENT I PP All DT accesses NNS should MD be VB logged VVN and CC the DT log NN data NNS should MD be VB held VVN for IN a DT predetermined VVN period NN . SENT Log NN data NNS should MD be VB analyzed VVN regularly RB for IN monitoring NN . SENT When WRB an DT information NN system NN is VBZ changed VVN , , the DT contents NNS , , necessity NN and CC schedule NN of IN the DT change NN , , should MD be VB reported VVN to TO the DT administrator NN for IN approval NN . SENT Before IN the DT changed JJ system NN is VBZ installed VVN on IN the DT production NN machine NN , , the DT operation NN of IN the DT system NN should MD be VB validated VVN on IN another DT machine NN . SENT For IN updating VVG , , the DT current JJ state NN should MD be VB stored VVN , , so RB that IN immediate JJ recovery NN will MD be VB possible JJ . SENT These DT should MD be VB done VVN outside IN business NN hours NNS . SENT In IN order NN to TO make VV it PP possible JJ to TO take VV prompt JJ action NN in IN an DT emergency NN , , spare JJ systems NNS should MD be VB provided VVN for IN the DT systems NNS that WDT are VBP identified VVN as IN an DT especially RB important JJ system NN by IN the DT IT PP Security NP Committee NP . SENT The DT emergency NN spare JJ systems NNS should MD be VB validated VVN at IN least JJS once IN every DT quarter NN . SENT Education NN for IN managers NNS should MD be VB provided VVN regularly RB . SENT Information NN systems NNS should MD be VB backed VVN up RP regularly RB . SENT II NP For IN operations NNS that IN the DT IT PP Security NP Committee NP identify VV as IN those DT that WDT might MD seriously RB effect VV information NN systems NNS , , all DT accesses NNS should MD be VB logged VVN and CC the DT log NN data NNS should MD be VB held VVN for IN a DT predetermined VVN period NN . SENT When WRB an DT information NN system NN is VBZ changed VVN , , the DT contents NNS , , necessity NN and CC schedule NN of IN the DT change NN should MD be VB reported VVN to TO the DT administrator NN . SENT If IN the DT administrator NN considers VVZ that IN the DT change NN would MD seriously RB effect VV information NN systems NNS , , the DT most RBS important JJ procedure NN should MD be VB changed VVN outside IN business NN hours NNS after IN preparing VVG for IN recovery NN from IN the DT current JJ state NN If IN the DT influence NN to TO the DT information NN system NN is VBZ considered VVN to TO be VB trivial JJ , , the DT change NN is VBZ made VVN under IN instructions NNS from IN the DT administrator NN . SENT Information NN systems NNS should MD be VB backed VVN up RP regularly RB . SENT III NP When WRB an DT information NN system NN is VBZ connected VVN to TO the DT network NN , , necessary JJ items NNS should MD be VB reported VVN to TO the DT administrator NN according VVG to TO the DT Instruction NN Manual NP for IN approval NN of IN the DT connection NN created VVN by IN the DT administrator NN . SENT The DT configuration NN of IN each DT information NN system NN should MD be VB defined VVN in IN the DT corresponding JJ implementation NN procedure NN manual JJ . SENT IV NP Handling NN can MD be VB made VVN freely RB . SENT No DT network NN connection NN should MD be VB made VVN without IN approval NN . SENT The DT following VVG are VBP examples NNS of IN regulations NNS concerning VVG the DT use NN of IN information NN systems NNS . SENT Example NN Regulations NNS concerning VVG the DT use NN of IN information NN systems NNS Prohibition NN of IN non JJ business NN use NN of IN information NN systems NNS Use NN of IN an DT information NN system NN or CC network NN resource NN is VBZ permitted VVN only RB when WRB it PP is VBZ made VVN for IN business NN purposes NNS . SENT Access NN to TO information NN systems NNS , , use NN of IN mail NN addresses NNS , , and CC access NN to TO the DT Internet NN for IN non JJ business NN purposes NNS , , are VBP not RB allowed VVN . SENT Prohibition NN of IN extraction NN of IN business NN data NNS The DT staff NN should MD not RB bring VV class NN I NN business NN data NNS out RB of IN the DT ministry NN or CC agency NN . SENT The DT staff NN should MD not RB take VV media NNS on IN which WDT personally RB owned VVN data NNS is VBZ stored VVN to TO a DT place NN where WRB class NN information NN assets NNS are VBP installed VVN . SENT This DT regulation NN does VVZ not RB apply VV when WRB the DT chief NN of IN an DT organization NN to TO which WDT the DT staff NN member NN belongs VVZ such JJ as IN a DT section NN chief NN or CC room NN chief NN gave VVD permission NN to TO that DT effect NN . SENT For IN example NN , , the DT following VVG activities NNS require VVP permission NN . SENT bringing VVG the DT information NN stored VVD in IN a DT mobile JJ terminal NN or CC storage NN medium NN out IN of IN the DT ministry NN or CC agency NN , , taking VVG personal JJ information NN into IN an DT office NN where WRB the DT above JJ information NN is VBZ installed VVN , , transferring VVG personal JJ data NNS over IN a DT network NN sending VVG and CC receiving VVG data NNS to TO and CC from IN the DT address NN of IN a DT private JJ person NN by IN e NN mail NN , , and CC so RB forth RB . SENT Prohibition NN of IN installation NN of IN unauthorized JJ software NN The DT staff NN should MD not RB install VV software NN that WDT is VBZ not RB authorized VVN by IN the DT section NN of IN information NN system NN management NN on IN their PP$ PCs NNS given VVN to TO them PP from IN the DT ministry NN or CC agency NN . SENT Among IN pieces NNS of IN information NN strictly RB prohibited VVN by IN that DT section NN are VBP monitoring VVG software NN for IN eavesdropping NN the DT information NN over IN the DT network NN , , security NN related JJ software NN for IN scanning VVG the DT network NN status NN , , and CC hacking VVG software NN . SENT Software NN to TO increase VV the DT efficiency NN of IN work NN can MD be VB used VVN by IN permission NN of IN the DT officer NN in IN charge NN of IN IT PP security NN . SENT Prohibition NN of IN change NN of IN device NN configuration NN The DT staff NN should MD not RB make VV any DT device NN addition NN or CC change NN to TO their PP$ PCs NNS given VVN to TO them PP from IN the DT ministry NN or CC agency NN . SENT The DT addition NN of IN a DT modem NN or CC other JJ similar JJ devices NNS to TO connect VV to TO other JJ environments NNS such JJ as IN the DT Internet NN over IN a DT network NN or CC making VVG a DT mechanism NN to TO allow VV access NN from IN outside IN the DT ministry NN or CC agency NN should MD be VB prohibited VVN ii NP Access NP control NN Access NP to TO information NN should MD be VB permitted VVN based VVN on IN the DT business NN requirements NNS . SENT Access NN permission NN should MD include VV provisions NNS about IN the DT authority NN and CC responsibility NN of IN the DT users NNS . SENT The DT password NN management NN procedure NN on IN the DT system NN administrator's NN side NN , , and CC the DT authority NN of IN the DT system NN administrator NN , , should MD also RB be VB defined VVN . SENT For IN important JJ information NN systems NNS , , specific JJ access NN control NN for IN individual JJ systems NNS access NN control NN using VVG special JJ personal JJ authentication NN , , for IN example NN should MD be VB defined VVN . SENT The DT standard NN of IN permitting VVG connection NN from IN outside JJ users NNS , , or CC connection NN from IN a DT mobile JJ terminal NN and CC requirements NNS for IN accessing VVG information NN and CC information NN systems NNS , , should MD also RB be VB defined VVN . SENT In IN addition NN , , for IN connection NN from IN local JJ bureaus NN Regional JJ bureaus NNS and CC departments NNS via IN leased VVN lines NNS , , measures NNS such JJ as IN access NN control NN to TO increase VV security NN should MD be VB taken VVN depending VVG on IN the DT conditions NNS of IN those DT lines NNS . SENT Example NN Registration NN of IN users NNS Formal JJ procedures NNS for IN registering VVG users NNS or CC canceling VVG user NN registration NN should MD be VB used VVN to TO authorize VV or CC cancel VV access NN rights NNS to TO information NN systems NNS . SENT Considerations NNS for IN logging VVG in RP and CC logging VVG out RP The DT procedure NN for IN login NN and CC logout NN should MD be VB defined VVN in IN the DT implementation NN procedure NN . SENT Limitation NN of IN automatic JJ mail NN transfer NN Granting VVG access NN rights NNS to TO servers NNS iii NP Development NP , , implementation NN and CC maintenance NN of IN systems NNS When WRB an DT information NN system NN is VBZ developed VVN , , introduced VVN , , or CC updated VVN , , risk NN analysis NN should MD be VB made VVN according VVG to TO the DT Policy NN to TO define VV the DT necessary JJ items NNS for IN taking VVG proper JJ IT PP security NN measures NNS . SENT Security NN items NNS for IN the DT consignee NN of IN system NN development NN should MD also RB be VB defined VVN . SENT When WRB new JJ devices NNS , , software NN , , storage NN media NNS , , or CC services NNS are VBP introduced VVN for IN the DT information NN system NN , , they PP should MD be VB checked VVN in IN advance NN for IN any DT failure NN or CC defect NN that WDT might MD compromise VV the DT security NN of IN the DT system NN . SENT In IN addition NN , , their PP$ specifications NNS should MD be VB dealt VVN with IN carefully RB . SENT If IN a DT device NN is VBZ discarded VVN , , repaired VVN or CC returned VVN , , an DT appropriate JJ measure NN should MD be VB taken VVN to TO prevent VV leakage NN of IN the DT information NN in IN the DT device NN . SENT For IN example NN , , if IN a DT hard JJ disk NN drive NN is VBZ to TO be VB discarded VVN , , the DT contents NNS should MD be VB completely RB deleted VVN before IN it PP is VBZ discarded VVN . SENT Example NN Confidentiality NN obligation NN Management NN of IN reconsignment NN Management NN of IN information NN system NN specifications NNS , , etc FW . SENT Requirements NNS under IN various JJ guidelines NNS for IN government NN procurement NN 8 CD 6 CD ISO NP 15408 CD , , etc FW . SENT Work NN area NN , , work NN management NN Handling NN of IN incidents NNS relating VVG to TO IT PP security NN in IN working VVG state NN dSubmission NN of IN a DT work NN report NN Procedure NN at IN the DT time NN of IN bringing VVG in IN and CC out IN equipment NN Vulnerability NN test NN at IN the DT time NN of IN introduction NN Submission NN of IN source NN code NN Requirements NNS for IN observing VVG the DT Policy NN in IN accordance NN with IN other JJ information NN systems NNS Regulations NNS concerning VVG a DT monitoring NN system NN and CC the DT correction NN of IN information NN systems NNS should MD be VB prescribed VVN to TO ensure VV security NN during IN maintenance NN . SENT In IN doing VVG so RB , , 7 CD iv NN Operation NN agreement NN for IN consignment NN to TO outside JJ contractors NNS shall MD also RB be VB taken VVN into IN consideration NN Example NN A DT 24 CD hour NN monitoring NN system NN for IN information NN systems NNS , , guidelines NNS for IN installing VVG correction NN programs NNS patch NN programs NNS , , time NN of IN installing VVG such JJ programs NNS , , etc FW . SENT iv NN Countermeasures NNS against IN computer NN viruses NNS Preparation NN of IN the DT system NN to TO cope VV with IN computer NN viruses NNS , , regulations NNS to TO be VB observed VVN by IN the DT staff NN and CC others NNS , , should MD be VB set VVN forth RB as IN the DT countermeasures NNS against IN viruses NNS . SENT The DT actions NNS to TO be VB taken VVN when WRB a DT computer NN virus NN is VBZ found VVN are VBP defined VVN as IN an DT action NN against IN an DT intrusion NN into IN an DT information NN system NN . SENT 8 CD 6 CD Major JJ guidelines NNS for IN government NN procurement NN The DT following VVG policies NNS that WDT should MD be VB observed VVN in IN procuring VVG hardware NN , , software NN and CC services NNS provide VVP the DT standards NNS for IN IT PP equipment NN and CC points NNS of IN concern NN in IN consignment NN to TO outside JJ contractors NNS , , etc FW . SENT from IN the DT viewpoint NN of IN ensuring VVG IT PP security NN . SENT Policy NN of IN Using VVG Products NPS with IN a DT High NP Level NP of IN Security NP , , etc FW . SENT in IN Procurement NN by IN Each DT Ministry NP and CC Agency NP approved VVD on IN March NP 29 CD , , 2001 CD by IN the DT Liaison NN Conference NN for IN the DT Ministries NNS and CC Agencies NNS Concerning VVG Promotion NP of IN Administration NP Computerization NN Promotion NP of IN Consignment NN of IN Information NP System NP related VVD Operations NP to TO Outside JJ Contractors NNS by IN Governmental JJ Administrative NP Organizations NP approved VVD on IN March NP 31 CD , , 2000 CD by IN the DT Liaison NN Conference NN for IN the DT Ministries NNS and CC Agencies NNS Concerning VVG Administration NP Information NP System NP . SENT Installation NN of IN unauthorized JJ software NN should MD be VB prohibited VVN . SENT This DT relates VVZ to TO compliance NN of IN laws NNS . SENT When WRB to TO receive VV data NN files NNS or CC software NN files NNS from IN an DT external JJ network NN , , anti JJ virus NN software NN should MD be VB executed VVN at IN both CC the DT server NN and CC terminal NN . SENT The DT vaccine NN program NN should MD be VB updated VVN to TO the DT latest JJS version NN , , and CC the DT virus NN information NN should MD be VB updated VVN frequently RB at IN both CC the DT serverand NN terminal NN . SENT The DT contents NNS of IN important JJ software NN , , information NN systems NNS , , and CC information NN should MD be VB checked VVN regularly RB v NN Collection NN of IN security NN information NN Because IN security NN holes NNS are VBP likely JJ to TO be VB found VVN on IN a DT daily JJ basis NN , , security NN information NN should MD be VB corrected VVN regularly RB . SENT For IN this DT purpose NN , , an DT information NN collection NN system NN , , information NN analysis NN procedure NN , , and CC sources NNS of IN information NN collection NN need VVP to TO be VB decided VVN . SENT If IN a DT serious JJ security NN hole NN is VBZ found VVN , , action NN should MD be VB promptly RB taken VVN . SENT 7 CD Operation NN i NP Monitoring NN of IN information NN systems NNS and CC making VVG sure JJ of IN policy NN observation NN operation NN management NN To TO ensure VV the DT effectiveness NN of IN the DT Policy NN and CC to TO prevent VV the DT Policy NN from IN being VBG abused VVN by IN attacks NNS to TO other JJ information NN systems NNS via IN the DT Internet NN , , constant JJ checking NN is VBZ essential JJ . SENT Specifically RB , , it PP should MD be VB checked VVN through IN network NN monitoring NN , , that IN users NNS of IN information NN system NN are VBP observing VVG the DT Policy NN , , and CC if IN unauthorized JJ access NN is VBZ made VVN to TO an DT information NN system NN via IN the DT Internet NN . SENT Thus RB self NN checking NN by IN each DT person NN in IN the DT target NN of IN policy NN application NN and CC network NN monitoring NN by IN self NN monitoring NN devices NNS , , etc FW . SENT of IN the DT information NN management NN section NN should MD be VB defined VVN . SENT This DT helps VVZ ensure VV the DT observance NN , , the DT evaluation NN of IN the DT problems NNS , , and CC the DT coordination NN of IN the DT Policy NN with IN the DT actual JJ conditions NNS . SENT To TO implement VV operation NN management NN properly RB , , it PP is VBZ required VVN to TO formulate VV an DT organization NN that WDT does VVZ not RB impose VV too RB much JJ burden NN on IN particular JJ persons NNS . SENT The DT organization NN is VBZ also RB required VVN to TO provide VV a DT quick JJ action NN in IN the DT case NN of IN a DT failure NN , , and CC to TO monitor VV the DT system NN constantly RB even RB during IN the DT failure NN . SENT Therefore RB , , necessary JJ measures NNS shall MD be VB prescribed VVN according VVG to TO the DT risk NN , , such JJ as IN installation NN of IN an DT intrusion NN detection NN system NN , , etc FW . SENT and CC establishment NN of IN a DT monitoring NN system NN . SENT Acquisition NN and CC analysis NN of IN the DT access NN log NN should MD also RB be VB defined VVN clearly RB . SENT The DT access NN log NN should MD be VB maintained VVN safely RB to TO prevent VV deletion NN or CC tampering VVG of IN data NNS or CC other JJ unauthorized JJ operations NNS . SENT Detailed JJ items NNS such JJ as IN retention NN period NN of IN the DT access NN log NN and CC number NN of IN persons NNS in IN charge NN of IN monitoring NN should MD be VB defined VVN in IN the DT implementation NN procedure NN . SENT ii NN Considerations NNS in IN operation NN management NN Operations NP of IN system NN and CC security NN management NN software NN , , including VVG the DT browsing NN of IN users NNS e SYM mail NN messages NNS , , should MD not RB violate VV the DT privacy NN of IN users NNS . SENT Due JJ consideration NN should MD be VB paid VVN to TO the DT fact NN that IN the DT security NN measures NNS may MD effect VV the DT privacy NN of IN the DT staff NN . SENT From IN this DT standpoint NN , , provisions NNS should MD be VB made VVN as RB to TO the DT time NN , , conditions NNS , , and CC organization NN that WDT allow VVP the DT use NN of IN the DT security NN procedure NN . SENT Desirably RB , , this DT issue NN receives VVZ the DT good JJ understanding NN of IN users NNS . SENT Example NN The DT system NN administrator NN can MD only RB see VV personal JJ e NN mail NN messages NNS in IN the DT presence NN of IN the DT executive NN in IN charge NN or CC another DT selected JJ person NN when WRB the DT executive NN has VHZ admitted VVN that IN a DT problem NN may MD occur VV with IN IT PP security NN . SENT iii NN Contingency NN plan VVP Specific JJ actions NNS to TO be VB taken VVN when WRB the DT IT PP security NN was VBD , , or CC might MD be VB violated VVN , , should MD be VB formulated VVN as IN a DT plan NN of IN emergency NN measures NNS . SENT This DT plan NN includes VVZ a DT series NN of IN operations NNS to TO take VV necessary JJ actions NNS , , such JJ as IN liaison NN when WRB the DT information NN asset NN was VBD violated VVN , , perpetuating VVG the DT evidence NN , , localizing VVG the DT damage NN , , and CC recovering VVG quickly RB and CC smoothly RB from IN the DT damage NN and CC to TO take VV measures NNS for IN preventing VVG recurrence NN of IN security NN violation NN . SENT In IN particular JJ , , measures NNS should MD be VB reviewed VVN thoroughly RB through IN validation NN and CC training NN , , so RB that IN the DT following VVG actions NNS can MD be VB conducted VVN easily RB . SENT deciding VVG measures NNS based VVN on IN examination NN of IN the DT cause NN , , identifying VVG the DT offender NN , , perpetuating VVG the DT evidence NN to TO prepare VV for IN receiving VVG legal JJ measures NNS and CC quick JJ recovery NN . SENT In IN addition NN , , actions NNS are VBP required VVN to TO prevent VV the DT damage NN from IN diffusing VVG to TO the DT information NN asset NN held VVN by IN you PP or CC to TO outside JJ information NN assets NNS . SENT If IN some DT persons NNS are VBP damaged VVN by IN the DT leakage NN of IN their PP$ information NN , , notice NN should MD be VB promptly RB given VVN to TO them PP . SENT Close JJ contact NN should MD be VB kept VVN with IN the DT police NN and CC other JJ agencies NNS concerned VVN if IN the DT case NN in IN question NN constitutes VVZ an DT infringement NN of IN the DT Law NN Concerning VVG Prohibition NN of IN Illegal JJ Access NP to TO Computer NP Systems NP Unauthorized JJ Computer NP Access NP Law NP . SENT As IN well RB , , easy JJ to TO understand VV emergency NN manuals NNS for IN administrators NNS and CC users NNS should MD be VB prepared VVN as IN an DT implementation NN procedure NN . SENT Items NNS to TO be VB included VVN in IN the DT plan NN of IN emergency NN measures NNS a DT Liaison NN The DT place NN for IN making VVG contact NN , , person NN in IN charge NN of IN liaison NN and CC communication NN means VVZ Example NN Person NP in IN charge NN of IN information NN summarization NN place NN for IN making VVG contact NN , , section NN or CC department NN of IN information NN asset NN management NN , , liaison NN system NN in IN the DT ministry NN or CC agency NN , , Branch NP for IN IT PP Security NP , , Cabinet NP Office NP for IN National NP Security NP Affairs NPS and CC Crisis NN Management NN , , agencies NNS concerned VVD including VVG the DT policy NN , , and CC others NNS b SYM Survey NN of IN the DT case NN The DT survey NN method NN and CC survey NN items NNS to TO understand VV the DT violation NN case NN should MD be VB decided VVN . SENT Example NN Classifying VVG the DT symptoms NNS , , identifying VVG the DT cause NN , , determining VVG the DT scope NN of IN damage NN or CC influence NN , , and CC recording VVG c NN Coping VVG with IN the DT case NN Criteria NNS of IN deciding VVG actions NNS , , the DT person NN who WP assumes VVZ the DT responsibility NN , , the DT person NN in IN charge NN of IN implementation NN , , implementation NN procedure NN , , etc FW . SENT are VBP determined VVN . SENT Example NN Notification NN , , disconnecting VVG the DT network NN , , shutting VVG down RP the DT information NN system NN , , obtaining VVG the DT logs NNS access NN log NN , , action NN log NN , , etc FW . SENT , , recovery NN , , and CC checking VVG for IN recurrence NN d NN Measure NN to TO prevent VV the DT recurrence NN of IN security NN violation NN The DT violation NN case NN should MD be VB surveyed VVN to TO decide VV the DT measure NN to TO prevent VV the DT recurrence NN of IN a DT security NN violation NN . SENT Example NN Reporting NP to TO the DT IT PP Security NP Committee NP , , risk NN analysis NN in IN relation NN to TO the DT case NN , , and CC formulating VVG the DT measure NN to TO prevent VV the DT recurrence NN of IN security NN violation NN including VVG evaluation NN of IN the DT Policy NP iv NN Operation NN agreement NN for IN consignment NN to TO outside JJ contractors NNS When WRB operation NN is VBZ carried VVN out RP by IN outside JJ consignees NNS , , necessary JJ requirements NNS for IN policy NN observation NN should MD be VB prescribed VVN in IN an DT agreement NN , , etc FW . SENT Specifically RB , , the DT necessary JJ requirements NNS in IN the DT following VVG examples NNS should MD be VB defined VVN clearly RB depending VVG on IN the DT content NN of IN consignment NN to TO outside JJ contractors NNS . SENT Example NN Confidentiality NN obligation NN Management NN of IN reconsignment NN Submission NN and CC management NN of IN record NN on IN system NN management NN and CC failure NN Management NN of IN information NN system NN specifications NNS , , etc FW . SENT Measures NNS concerning VVG monitoring NN Emergency NN measures VVZ Collection NN of IN information NN on IN IT PP security NN Version NP control NN of IN software NN Other JJ requirements NNS for IN continuously RB maintaining VVG IT PP security NN 8 CD Compliance NN of IN laws NNS A DT provision NN is VBZ made VVN about IN the DT observance NN of IN the DT related JJ laws NNS . SENT Laws NNS and CC administrative JJ guidance NN to TO be VB observed VVN should MD be VB enumerated VVN so RB that IN they PP are VBP not RB violated VVN They PP include VVP the DT Copyright NP Act NP , , the DT Law NN Concerning VVG Prohibition NN of IN Illegal JJ Access NP to TO Computer NP Systems NP Unauthorized JJ Computer NP Access NP Law NP , , and CC the DT Act NP for IN Protection NP of IN Computer NP Processed VVD Personal NP Data NP held VVD by IN Administrative NP Organizations NP . SENT 9 CD Actions NNS taken VVN against IN violation NN of IN IT PP security NN policy NN The DT Policy NN stipulates VVZ that IN the DT persons NNS who WP made VVD violation NN of IN the DT Policy NP and CC their PP$ superior JJ officers NNS can MD be VB punished VVN under IN the DT National NP Public NP Service NP Law NP , , depending VVG on IN the DT seriousness NN of IN the DT violation NN . SENT This DT stipulation NN is VBZ included VVN in IN order NN to TO suppress VV the DT actions NNS of IN those DT who WP intend VVP to TO make VV light NN of IN the DT Policy NP and CC the DT implementation NN procedure NN and CC to TO maintain VV the DT required VVN level NN of IN IT PP security NN . SENT If IN any DT actions NNS that WDT may MD infringe VV IT PP security NN are VBP observed VVN in IN business NN , , the DT superior JJ of IN the DT officer NN who WP made VVD the DT infringement NN , , should MD immediately RB order VV the DT person NN who WP made VVD the DT actions NNS to TO stop VV using VVG the DT terminal NN . SENT 10 CD Assessment NP and CC review VV It PP should MD be VB provided VVN that IN assessment NN and CC review NN of IN the DT Policy NN be VB performed VVN periodically RB in IN response NN to TO the DT evaluation NN of IN the DT Policy NN and CC IT PP security NN measures NNS , , and CC to TO cope VV with IN alteration NN of IN the DT information NN system NN and CC emergence NN of IN new JJ threats NNS . SENT The DT IT PP Security NP Committee NP should MD decide VV the DT implementation NN of IN assessment NN and CC review NN of IN the DT Policy NN by IN right NN of IN the DT committee NN . SENT i NP Auditing VVG IT PP security NN of IN the DT information NN system NN should MD be VB audited VVN , , and CC the DT results NNS should MD be VB reflected VVN in IN the DT assessment NN and CC review NN of IN the DT Policy NN . SENT The DT Committee's NP duties NNS relating VVG to TO auditing NN shall MD be VB defined VVN clearly RB , , and CC systems NNS and CC authority NN necessary JJ for IN fulfilling VVG the DT duties NNS shall MD be VB prescribed VVN . SENT The DT Audit NP Group NP and CC other JJ auditors NNS should MD be VB ensured VVN to TO be VB neutral JJ in IN terms NNS of IN auditing NN and CC report NN on IN IT PP security NN measures NNS within IN an DT organization NN , , and CC they PP should MD be VB clearly RB given VVN the DT authority NN necessary JJ for IN auditing VVG such JJ as IN access NN to TO information NN . SENT In IN addition NN , , to TO minimize VV the DT risk NN of IN leakage NN of IN information NN in IN auditing VVG work NN , , the DT standards NNS for IN storage NN , , management NN and CC confidentiality NN obligation NN , , etc FW . SENT should MD be VB established VVN with IN respect NN to TO information NN relating VVG to TO auditing NN handled VVD by IN the DT Audit NP Group NP , , etc FW . SENT The DT auditors NNS should MD be VB qualified VVN persons NNS with IN expertise NN . SENT For IN fair JJ auditing NN , , auditors NNS who WP have VHP no DT direct JJ connection NN with IN the DT system NN to TO be VB audited VVN are VBP desirable JJ , , and CC the DT utilization NN of IN auditors NNS outside IN the DT organization NN should MD also RB be VB taken VVN into IN consideration NN . SENT ii NP Inspection NP As IN for IN the DT implementation NN states NNS of IN IT PP security NN measures NNS in IN accordance NN with IN the DT Policy NN , , questionnaires NNS should MD be VB issued VVN to TO the DT users NNS , , or CC autonomous JJ inspections NNS should MD be VB made VVN . SENT The DT results NNS should MD be VB used VVN when WRB the DT Policy NN is VBZ updated VVN to TO a DT more RBR practical JJ one NN . SENT iii NNS Updating VVG the DT Policy NN Updating VVG the DT Policy NN , , as RB in IN the DT case NN of IN setting VVG up RP the DT Policy NN , , requires VVZ a DT procedure NN that WDT justifies VVZ updating VVG . SENT The DT assessments NNS by IN specialists NNS of IN IT PP security NN should MD be VB utilized VVN at IN that DT time NN , , and CC reference NN to TO opinions NNS of IN the DT related JJ departments NNS and CC bureaus NN is VBZ required VVN . SENT The DT Policy NN should MD define VV a DT procedure NN that WDT includes VVZ opinions NNS about IN the DT update NN draft NN from IN the DT related JJ departments NNS and CC bureaus NNS reflected VVD in IN the DT Policy NN , , and CC provide VV that IN the DT Policy NP has VHZ to TO be VB adopted VVN by IN the DT IT PP Security NP Committee NP . SENT 6 CD Decision NN of IN the DT Policy NP The NP set VVD up RP Policy NP draft NN requires VVZ a DT procedure NN that WDT justifies VVZ the DT draft NN . SENT The DT assessments NNS by IN specialists NNS of IN IT PP security NN should MD be VB used VVN at IN that DT time NN and CC reference NN to TO the DT opinions NNS of IN related JJ departments NNS and CC bureaus NN is VBZ required VVN . SENT The DT Policy NN should MD define VV a DT procedure NN to TO include VV opinions NNS about IN the DT draft NN from IN the DT related JJ departments NNS and CC bureaus NNS reflected VVD in IN the DT Policy NN , , and CC provide VV that IN the DT Policy NP has VHZ to TO be VB adopted VVN by IN the DT government NN ministries NNS and CC agencies NNS . SENT 3 LS . SENT Introduction NN 1 CD Outline NN of IN introduction NN The DT Policy NN should MD be VB thoroughly RB known VVN to TO the DT related JJ persons NNS before IN its PP$ operation NN is VBZ started VVN so RB that IN the DT Policy NN can MD be VB positively RB implemented VVN . SENT 2 CD Preparation NN of IN implementation NN procedure NN The DT implementation NN procedure NN provides VVZ how WRB the DT contents NNS of IN the DT Policy NN should MD be VB put VVN into IN operation NN for IN actual JJ work NN or CC in IN the DT information NN system NN . SENT The DT implementation NN procedure NN is VBZ equivalent JJ to TO a DT manual JJ that WDT defines VVZ what WP each DT person NN who WP should MD observe VV the DT Policy NN must MD do VV to TO maintain VV IT PP security NN according VVG to TO the DT information NN handled VVD and CC the DT work NN to TO be VB done VVN . SENT Therefore RB , , the DT implementation NN procedure NN has VHZ to TO be VB determined VVN for IN individual JJ cases NNS when WRB necessary JJ , , according VVG to TO the DT actual JJ working NN environment NN . SENT It PP should MD be VB provided VVN that IN the DT existing JJ regulations NNS could MD be VB used VVN where WRB applicable JJ . SENT In IN particular JJ , , the DT implementation NN procedure NN plays VVZ a DT very RB important JJ role NN in IN ensuring VVG continuity NN and CC consistency NN of IN measures NNS by IN making VVG rules NNS for IN procedure NN of IN the DT Policy NN based VVN measures NNS . SENT For IN example NN , , by IN the DT implementation NN procedure NN , , the DT level NN of IN security NN can MD be VB maintained VVN when WRB a DT person NN in IN charge NN is VBZ relocated VVN , , and CC a DT uniform JJ level NN of IN security NN can MD be VB ensured VVN when WRB departments NNS , , local JJ bureaus NN , , etc FW . SENT connect VV their PP$ information NN systems NNS with IN each DT other JJ . SENT It PP shall MD be VB allowed VVN that IN the DT implementation NN procedure NN be VB set VVN up RP , , updated VVN , , and CC abolished VVD by IN the DT system NN administrator NN , , etc FW . SENT without IN necessarily RB obtaining VVG approval NN from IN the DT IT PP Security NP Committee NP since IN it PP is VBZ effective JJ to TO prepare VV the DT implementation NN procedure NN based VVN on IN the DT standard NN of IN measures NNS for IN individual JJ purposes NNS and CC flexibly RB carry VV out RP the DT cycle NN for IN implementation NN , , including VVG evaluation NN and CC review NN . SENT 3 CD Conformity NN to TO the DT Policy NP The NP IT PP Security NP Committee NP has VHZ the DT IT PP security NN officer NN verify VV that IN the DT implementation NN procedure NN , , and CC what WP are VBP actually RB implemented VVN , , conform VV to TO the DT Policy NN before IN it PP is VBZ put VVN into IN operation NN . SENT The DT Committee NP collects VVZ and CC studies VVZ information NN about IN conformity NN to TO the DT Policy NN and CC provides VVZ appropriate JJ advice NN or CC actions NNS for IN the DT operation NN of IN the DT Policy NN in IN advance NN . SENT The DT officer NN in IN charge NN of IN IT PP security NN should MD verify VV that IN the DT physical JJ , , human JJ , , and CC technical JJ IT PP security NN measures NNS , , as RB well RB as IN the DT emergency NN action NN plan NN and CC the DT implementation NN procedure NN introduced VVN for IN all DT information NN assets NNS s VVZ he PP is VBZ responsible JJ for IN , , conform VV to TO the DT Policy NN . SENT 4 CD Distribution NN and CC briefing NN The DT IT PP Security NP Committee NP distributes VVZ prints NNS of IN the DT Policy NN or CC holds VVZ briefing NN about IN the DT Policy NN to TO make VV the DT Policy NN known VVN to TO related JJ personnel NNS . SENT Each DT department NN and CC bureau NN will MD be VB responsible JJ for IN making VVG the DT implementation NN procedure NN known VVN to TO related JJ personnel NNS . SENT It PP is VBZ desirable JJ that IN the DT necessary JJ part NN of IN the DT Policy NN is VBZ made VVN known VVN to TO outside JJ consignees NNS to TO have VH them PP agree VV to TO the DT conformance NN to TO the DT Policy NN . SENT The DT implementation NN procedure NN is VBZ confidential JJ . SENT The DT related JJ persons NNS , , including VVG outside JJ consignees NNS , , should MD handle VV the DT procedure NN under IN strict JJ control NN . SENT 4 LS . SENT Operation NN Establishment NN of IN organizations NNS or CC systems NNS , , monitoring VVG , , actions NNS taken VVN at IN the DT time NN of IN intrusion NN , , and CC other JJ measures NNS , , should MD be VB provided VVN for IN positive JJ operation NN of IN the DT Policy NN . SENT 1 CD Operation NN management NN Persons NP in IN charge NN of IN IT PP security NN in IN information NN management NN sections NNS and CC the DT departments NNS and CC bureaus NNS , , bureaus NNS and CC departments NNS should MD make VV sure RB that IN physical JJ , , human JJ and CC technical JJ IT PP security NN measures NNS are VBP implemented VVN appropriately RB under IN the DT IT PP Security NP Committee NP . SENT If IN a DT violation NN of IN the DT measures NNS that WDT could MD cause VV a DT serious JJ problem NN for IN IT PP security NN is VBZ found VVN , , actions NNS should MD be VB taken VVN in IN accordance NN with IN a DT plan NN of IN emergency NN measures NNS . SENT These DT actions NNS must MD be VB managed VVN with IN tight JJ control NN ready JJ for IN use NN for IN the DT assessment NN or CC review NN of IN the DT Policy NN because IN they PP can MD serve VV , , not RB only RB as IN proof NN of IN violation NN , , but CC as IN materials NNS for IN measuring VVG the DT practicability NN of IN the DT Policy NN . SENT 2 CD Actions NNS taken VVN in IN case NN of IN intrusion NN 1 CD Training NP Training NP should MD be VB performed VVN regularly RB for IN smooth JJ implementation NN of IN a DT plan NN of IN emergency NN measures NNS . SENT The DT results NNS of IN the DT training NN are VBP used VVN for IN assessment NN and CC review NN of IN the DT plan NN . SENT 2 CD Notes NNS for IN liaison NN The DT method NN of IN liaison NN should MD be VB invulnerable JJ to TO problems NNS of IN IT PP security NN . SENT Use NN of IN e NN mail NN for IN forwarding NN sensitive JJ information NN should MD be VB avoided VVN to TO protect VV it PP from IN eavesdropping NN . SENT It PP is VBZ desirable JJ that IN more JJR than IN one CD communication NN means NNS be VB provided VVN around IN the DT clock NN for IN contacting VVG the DT persons NNS in IN charge NN of IN IT PP security NN . SENT 3 CD Notes NNS for IN investigation NN Investigation NP must MD not RB cause VV liaison NN any DT delay NN . SENT 4 CD Notes NNS for IN taking VVG actions NNS The DT scope NN of IN a DT person NN in IN charge NN for IN taking VVG actions NNS without IN the DT permission NN of IN the DT responsible JJ person NN should MD be VB defined VVN . SENT Appropriate JJ considerations NNS should MD be VB given VVN to TO a DT case NN where WRB the DT responsible JJ person NN cannot NN be VB reached VVN , , and CC the DT authority NN has VHZ to TO be VB entrusted VVN to TO his PP$ replacement NN and CC an DT ex JJ post NN facto JJ report NN is VBZ needed VVN . SENT 5 CD Prevention NN of IN repeated JJ intrusions NNS As IN for IN prevention NN of IN repeated JJ intrusions NNS , , the DT results NNS of IN discussion NN of IN the DT matters NNS related VVN to TO the DT Policy NN , , various JJ actions NNS , , a DT plan NN of IN emergency NN measures NNS , , and CC the DT assessment NN and CC review NN of IN the DT implementation NN procedure NN should MD be VB indicated VVN , , with IN attention NN paid VVN to TO the DT result NN of IN risk NN analysis NN about IN the DT intrusion NN that IN occurred VVN . SENT 5 LS . SENT Assessment NP and CC Review NP Regular JJ assessment NN and CC review NN of IN the DT standard NN of IN measures NNS are VBP important JJ . SENT It PP should MD be VB done VVN in IN consideration NN of IN the DT evaluation NN of IN the DT Policy NP and CC the DT IT PP security NN measure NN , , changes NNS of IN the DT information NN system NN and CC emergence NN of IN new JJ threats NNS . SENT The DT assessment NN and CC review NN should MD be VB done VVN under IN the DT IT PP Security NP Committee NP to TO keep VV the DT Policy NN practical JJ and CC keep VV the DT IT PP security NN level NN high JJ . SENT 1 CD Auditing NN When WRB implementing VVG IT PP security NN measures NNS , , it PP is VBZ important JJ for IN ministries NNS and CC agencies NNS to TO be VB able JJ to TO explain VV that IN they PP have VHP been VBN appropriately RB carrying VVG out RP the DT Policy NN based VVN measures NNS from IN an DT objective JJ viewpoint NN . SENT For IN this DT purpose NN , , auditing NN should MD be VB implemented VVN appropriately RB . SENT Based VVN on IN this DT , , the DT Committee NP shall MD implement VV appropriate JJ review NN on IN the DT implementation NN status NN of IN measures NNS . SENT Specifically RB , , the DT Committee NP shall MD audit VV the DT status NN of IN planned JJ policy NN observation NN and CC make VV the DT Audit NP Group NP carry VV out RP this DT auditing NN work NN . SENT In IN addition NN , , the DT system NN administrator NN shall MD implement VV appropriate JJ storage NN and CC management NN of IN records NNS , , etc FW . SENT that DT are VBP necessary JJ for IN auditing NN , , and CC make VV sure JJ of IN policy NN observation NN when WRB developing VVG , , introducing VVG and CC operating VVG an DT information NN system NN , , by IN utilizing VVG necessary JJ auditing NN of IN the DT system NN , , including VVG investigation NN of IN the DT vulnerability NN of IN the DT information NN system NN . SENT If IN an DT external JJ auditing NN organization NN is VBZ used VVN , , sufficient JJ consideration NN should MD be VB given VVN to TO its PP$ credit NN . SENT It PP should MD capture VV weak JJ points NNS of IN the DT information NN system NN subject JJ to TO the DT audit NN . SENT 2 CD Updating VVG the DT Policy NN Updating VVG the DT Policy NN for IN the DT first JJ time NN after IN its PP$ introduction NN requires VVZ special JJ consideration NN . SENT Since IN differences NNS between IN the DT Policy NP and CC the DT reality NN have VH to TO be VB considered VVN , , it PP is VBZ desirable JJ to TO capture VV the DT actual JJ states NNS by IN canvassing VVG opinions NNS from IN the DT sections NNS concerned VVN , , or CC by IN other JJ means NNS . SENT Updating VVG the DT Policy NN should MD begin VV with IN risk NN analysis NN to TO make VV it PP practical JJ . SENT Information NN about IN new JJ methods NNS of IN attacking VVG systems NNS should MD be VB collected VVN for IN reference NN purposes NNS for IN updating VVG the DT Policy NN . SENT The DT updated VVN Policy NN has VHZ to TO be VB distributed VVN and CC applied VVN . SENT This DT requires VVZ as IN much JJ trouble NN as IN that WDT required VVD when WRB the DT Policy NN was VBD introduced VVN . SENT Efforts NNS should MD be VB made VVN to TO seek VV efficient JJ methods NNS . SENT 3 CD Reflection NN to TO the DT Guidelines NNS The DT results NNS of IN assessment NN and CC review NN must MD be VB reflected VVN in IN these DT guidelines NNS . SENT