Part 1

First, you will create a 2-3 page section in the plan to list all of the policies that you would have for your organization and a brief description of what each policy will contain. After the risks have been identified within an organization, you must devise a plan that will provide the best possible protection without significantly impacting daily operations. Then, you must write and implement written policies that will inform everyone within the organization what can and cannot be done while they are connected to the Internet. Written polices need to adhere to the following guidelines:

• No more than 2 pages
• Clearly identified rules
• Clearly identified punishments if rules are not followed.
• A way to monitor the network for violations of the policy.

Part 2

Security Policies Section

• Identify what written polices need to be created for your organization.
• For each policy, you will address how you plan to monitor the policy.
• For each policy, you will provide what you feel the appropriate punishment should be for violators. These punishments must be able to be enforceable, not just a threat.
• For each policy, you will identify a timetable for when each policy should be reviewed and updated and who will do the review.

Part 3

Incident Response Section

The second task this week is to prepare for how you would handle an incident. It is best to have a thorough, rehearsed plan to be prepared for a potential incident. This will help to limit the damage and it will help recovery afterward. You will create an Incident Response section of 2-3 pages that includes the actions that need to occur when an incident is in progress.

• Identify the process of how your organization will identify an incident.
• Identify the process for classifying the incident.
• What are the criteria for each classification within the organization?
• Identify what the response will be for each classification identified.
• Identify a general plan to recover from the incident.
• Identify a process for evaluating the incident response plan after each incident has been mitigated.
• Discuss how the incident response plan will be tested and updated.