Security evaluation

Solution Preview

i HOPE THIS WILL GUIDE YOU AS YOU FILL OUT YOUR TEMPLATE
{BrieExecutive Summary
Briefly describe the activities of the assessment.
Talk about the importance of information security at the client organization.
Discuss security efforts that the organization has under taken.
Highlight three major security issues discovered that could significantly impact the operations of the organization.
Top-Ten List
A top-ten list is used to highlight the ten most urgent issues discovered during an assessment. Clients unfamiliar with security may be overwhelmed by a long list of problems. Putting the major issues together may allow the client to easily focus efforts on these problems first.
The list below contains the "top ten" findings, weaknesses, or vulnerabilities discovered during the site security assessment. Some of the issues listed here are coalesced from more than one section of the assessment report findings. Additional information about each is provided elsewhere in the report.
It is recommended that these be evaluated and addressed as soon as possible. These should be considered significant and may impact the operations of the {CLIENT ORGANIZATION}.
1. Information Security Policy
An information security policy is the primary guide for the implementation of all security measures. There is no formal policy specific to the {CLIENT ORGANIZATION}.
Recommendation: Develop an information security policy that specifically addresses the needs of the {CLIENT ORGANIZATION} and its mission. Use that policy as a basis for an effective security program.
2. {Security Issue #2}
{Brif description of Security Issue #8}
Recommendation: {Brief list of recommendations for Security Issue #8}
9. {Security Issue #9}
{Brief description of Security Issue #9}
Recommendation: {Brief list of recommendations for Security Issue #9}
10. {Security Issue #10}
{Brief description of Security Issue #10}
Recommendation: {Brief list of recommendations for Security Issue #10}

Introduction
Provide an overview of the report.
Scope
The scope is the boundaries of the project. It is used to describe the on-site activities.
Project Scope
In Scope
The following activities are within the scope of this project:
? Interviews with key staff members in charge of policy, administration, day-to-day operations, system administration, network management, and facilities management.
? A Visual Walk Through of the facilities with administrative and facilities personnel to assess physical security.
? A series of Network Scans to enumerate addressable devices and to assess each systems available network services. (These Scans will be conducted from within each center's network and from the outside.)
? A configuration and security assessment of at most ten key systems at each center.
Out of Scope
The following activities are NOT part of this security assessment:
? Penetration Testing of systems, networks, buildings, laboratories or facilities.
? Social Engineering to acquire sensitive information from staff members.
? Testing Disaster Recovery Plans, Business Continuity Plans, or Emergency Response Plans.
Site Activities Schedule
List the site activities.
First Day
Second Day
Third Day

Background Information
Use this section to talk about any relevant background information.
{CLIENT ORGANIZATION}
Describe the client organization.

Asset Identification
Describe the process of asset identification.
Assets of the {CLIENT ORGANIZATION}
The following lists document some of the {CLIENT ORGANIZATION} tangible and intangible assets. It should not be considered a complete and detailed list but should be used as a basis for further thought and discussion to identify assets.

Tangible Assets
? {List tangible assets.}

Intangible Assets
? {List intangible assets.}

Each item on these lists also has value associated with it. Each item's relative value changes over time. In order to determine the current value, it is often best to think in terms of recovery costs. What would it cost to restore or replace this asset in terms of time, effort, and money?
Threat Assessment
Describe the process of threat assessment.
Threats to the {CLIENT ORGANIZATION}
The following lists document some of the known threats to the {CLIENT ORGANIZATION}. It should not be considered a complete and detailed list but should be used to as a basis for further thought and discussion to identify threats.

Natural Threats
? {List Natural Threats.}

Intentional Threats
? {List Intentional Threats.}

Unintentional Threats
? {List Unintentional Threats.}

Laws, Regulations and Policy
Talk about the role of laws, regulation, and policy on the client organization.
Federal Law and Regulation
Outline federal laws and regulation that impact the client organization.
{CLIENT ORGANIZATION} Policy
Talk about the current policy at the ...