A.12.1 Security Procedures for IT Department Integrated Preview En

** FREE PREVIEW VERSION **

[Organization logo]

Commented [EU GDPR1]: All fields in this document marked by square brackets [ ] must be filled in.

[Organization name]

SECURITY PROCEDURES FOR IT DEPARTMENT

Code:

Commented [EU GDPR2]: Parts of this document that need to be specified in more detail may be drawn up as separate documents (policies/procedures).

Commented [EU GDPR3]: The document coding system should be in line with the organization's organization's existing system for document coding; in case such a system is not in place, this line may be deleted.

Version: Date of version: Created by: Approved by: Confidentiality level:

©2017 This template may be used by clients of Advisera Expert Solutions Ltd. www.advisera.com in accordance with the License Agreement.

[organization name]

[confidentiality level]

Change history Date

Version

Created by

Description of change

dd.mm.yyyy

0.1

EUGDPRAcademy

Basic document outline

Table of contents 1.

PURPOSE, SCOPE AND USERS..............................................................................................................3

2.

REFERENCE DOCUMENTS ....................................................................................................................3

3.

SECURITY PROCEDURES ......................................................................................................................3

3.1.

CHANGE MANAGEMENT  ............................................................................................................................... 3

3.2.

BACKUP  ....................................................................................................... ERROR! BOOKMARK NOT DEFINED.

3.2.1.

Backup procedure ...........................................................................Error! Bookmark not defined.

3.2.2.

Testing backup copies .....................................................................Error! Bookmark not defined.

3.3.

NETWORK SECURITY MANAGEMENT   ..................................................................ERROR! BOOKMARK NOT DEFINED.

3.4.

NETWORK SERVICES  ....................................................................................... ERROR! BOOKMARK NOT DEFINED.

3.5.

DISPOSAL AND DESTRUCTION OF EQUIPMENT AND MEDIA   ......................................ERROR! BOOKMARK NOT DEFINED.

3.5.1.

Equipment .......................................................................................Error! Bookmark not defined.

3.5.2.

Mobile storage media .....................................................................Error! Bookmark not defined.

3.5.3.

Paper media ....................................................................................Error! Bookmark not defined.

3.5.4.

Erasure and destruction records; commission for the destruction of data ....Error! Bookmark not

defined.

3.6.

SYSTEM MONITORING  .....................................................................................ERROR! BOOKMARK NOT DEFINED.

4.

MANAGING RECORDS KEPT ON THE BASIS OF THIS DOCUMENT .........ERROR! BOOKMARK NOT DEFINED.

5.

VALIDITY AND DOCUMENT MANAGEMENT ........................................ERROR! BOOKMARK NOT DEFINED.

Security Procedures for IT Department

ver [version] from [date]

Page 2 of 3

©2017 This template may be used by clients of Advisera Expert Solutions Ltd. www.advisera.com in accordance with the License Agreement.

[organization name]

[confidentiality level]

1. Purpose, scope and users The purpose of this document is to ensure correct and secure functioning of information and communication technology. This document is applied to the entire Information Security Management System (ISMS) scope, and to all personal data processing activities. Users of this document a re employees of [organizational unit for information and communication technology].

2. Reference documents 

ISO/IEC 27001 standard, clauses A.8.3.2, A.11.2.7, A.12.1.1, A.12.1.2, A.12.3.1, A.12.4.1, A.12.4.3, A.13.1.1, A.13.1.2, A.13.2.1, A.13.2.2, A.14.2.4



EU GDPR Article 32



Information Security Policy



[Mobile Device and Teleworking Policy]



[Information Classification Policy]



[Inventory of Assets]



[Supplier Security Policy]

3. Security Procedures 3.1.

Change management

Commented [EU GDPR4]: Delete this whole item if control A.12.1.2 is marked as inapplicable in the Statement of Applicability.

Each change to operational or production systems must be made in the following way:

Commented [EU GDPR5]: Delete this item if the Change Management Policy constitutes a separate document.

1. change may be proposed by [specify job functions] 2. change must be authorized by [j ob title], who must assess its justification for business and

How to manage changes in an ISMS according to ISO 27001 A.12.1.2 https://advisera.com/27001academy/blog/2015/09/14/how-tomanage-changes-in-an-isms-according-to-iso-27001-a-12-1-2/

potential negative security impacts 3. changes must be implemented by [job title] 4. [job title] is responsible for checking that the change h as been implemented in accordance with the requirement

To download full version of this document click here: https://advisera.com/eugdpracademy/documentation/security-procedures-for-it-department/

ver [version] from [date]

Page 3 of 3

©2017 This template may be used by clients of Advisera Expert Solutions Ltd. www.advisera.com in accordance with the License Agreement.

Commented [EU GDPR7]: It may be specified what is and what is not considered a change regulated by this document: installation of new software or of a new version of existing software, driver update, installation of patches, configuration changes, etc. Commented [EU GDPR8]: Another way of formulating the steps may be that the person responsible for implementing all subsequent steps is identified in the second step, thus this procedure need not define the responsible person in each step.

** END OF FREE PREVIEW **

Security Procedures for IT Department

Commented [EU GDPR6]: For more information about this topic, read this article: