Hi,
We could attempt this in phases.
Phase -1
Define the information classification policy. This would categorise the
information as Secret, Confidential,Internal,Public etc(number of
classifications and their definitions would vary with organisation). This
classification would primarily be done based on the impact of risks.This
would apply to all information (digital or otherwise).Once developed get the
policy endorsed by management.
Phase-2
Identify all information assets(and info. owners) that need to classified.
We could also limit the scope of this phase to critical components ( like
Data center assets and all assets at Corporate office).
Develop detailed checklists and questionnaires which will help info. owners
classify their assets.
Phase 3
Conduct awareness/training sessions to information owners on the proposed
classification levels and checklists.
Phase 4
Consolidate the information from various owners to ensure uniform
interpretation.
Jose Varghese
Paladion Networks
http://palisade.paladion.net
-----Original Message-----
From: Gary Everekyan [mailto:gary_everekyan@hotmail.com]
Sent: Tuesday, June 21, 2005 8:06 PM
To: 'Renato Ferro'; security-management@securityfocus.com
Subject: RE: Info Classification Project Scoping
my .2 cents...
I'd get the data owners involved in the overall Information object
classification.
I'll provide guidance that may be in classification categories (public,
restricted etc) and value (none to highly critical).
The largest hurdle is getting time from business units and coordinating the
information gathering.
So the scope would include:
Identification of information owners
Interviews with all the information owners Provide classifications and value
Project management Document that puts it all together.
HTH
Regards,
Gary Everekyan
CISSP, CISM, ISSAP,ISSPCS, MCSE, MCT
Information Security and Audit
"High achievement always takes place in the framework of high expectation" -
Jack Kinder
-----Original Message-----
From: Renato Ferro [mailto:renato.ferro@gmail.com]
Sent: Monday, June 20, 2005 12:38 PM
To: security-management@securityfocus.com
Subject: Info Classification Project Scoping
Dear Security Managers,
What is the best approach in order to compose a scope for a very large
organization information classification project.
Scoping the project by systems and applications, departments, business
units, mainframe or distributed systems? etc.
Any opinions would be helpful.
Thanks,
