Information Security Management Framework. Management of Information Security will be maintained to initiate and control the implementation of IT security measures within the organization in accordance with business requirements and relevant laws and regulations. The Director of Finance and Administration will maintain the IT security management framework, assign security roles and co-ordinate and review the implementation of information security across the College. Once a set of policies is defined they are to be submitted to the Policy Committee for review and to participate in the policy review and approval cycle. Once approved, the policies are published and communicated to employees and any relevant external parties that may be impacted by the change. This process would also occur with the review cycle timelines established by the Policy Committee. The criteria used during this evaluation includes current business requirements, risk assessments, relevant laws and regulations, and data risk assignment with high and low risk areas being clearly identified. The College’s IT Coordinator will be responsible and accountable for ensuring that the appropriate information security controls are implemented within the organization’s information systems. The management, development, review, and evaluation of IT security framework will be reviewed by the IT Coordinator and Director of Finance and Administration annually unless significant changes have occurred that would impact current policies. Examples that would initiate the review process include changes to the organizational environment, business circumstances, legal conditions, or technical environment within the College. This will ensure their continuing suitability, adequacy, and effectiveness of the information and the security measures in place. As part of the security within the College, local authorities (i.e. Law enforcement, Fire Department, etc.) as well as any external third parties (i.e. Support services, vendors, etc.) will be contacted to take action when required as outlined in the IT Disaster Recovery Plan (DRP) and the College Emergency Response Plan (ERP). These contacts and their associated information must be continually maintained to ensure business continuity and is a large part of the contingency planning process, and are to be reviewed on an ongoing basis. The IT Department as well as the supervisory staff within the College will be responsible for reviewing regulatory and legislative compliance with information processing and ...
