Why Security? A Commitment for [the Agency’s] Executives [CIO’s name] EC Presentation [date]

2 [the Agency] Today  [the Agency’s]  [the Agency’s] mission and vision  The way we do business is changing  Increased reliance on systems and technology  Increased threats to information and systems

3 Attempts to Access Sensitive Information Industrial Espionage Malicious Acts Pranks Natural Disaster Sabotage User Error Threats Public, Partner, Legislativ e Trust Lost Critical Operations Halted Sensitive Data Disclosed Services & Benefits Interrupted Integrity of [ Agency ] [ Agency ] Data & Reports Corrupted Assets Lost Potential Damage [the Agency’s] [the Agency’s] Systems Enterprise Security Risks Failed CFO Audit

4 Natural Disaster Sabotage User Error Threats Public, Partner, Legislativ e Trust Lost Critical Operations Halted Sensitive Data Disclosed Services & Benefits Interrupted Integrity of [Agency] [Agency] Data & Reports Corrupted Assets Lost Potential Damage [the Agency’s] [the Agency’s] Systems Enterprise Security Risks Failed CFO Audit Unauthorized Access to Sensitive Information

5 Natural Disaster Sabotage User Error Threats Public, Partner, Legislativ e Trust Lost Critical Operations Halted Sensitive Data Disclosed Services & Benefits Interrupted Integrity of [Agency] [Agency] Data & Reports Corrupted Assets Lost Potential Damage [the Agency’s] [the Agency’s] Systems Enterprise Security Risks Failed CFO Audit Industrial Espionage

6 Attempts to Access Sensitive Information Industrial Espionage Malicious Acts Pranks Natural Disaster Sabotage User Error Threats Public, Partner, Legislativ e Trust Lost Critical Operations Halted Sensitive Data Disclosed Services & Benefits Interrupted Integrity of [Agency’ [Agency’ Data & Reports Corrupted Assets Lost Potential Damage [the Agency’s] [the Agency’s] Systems Enterprise Security Risks Failed CFO Audit

7 Attempts to Access Sensitive Information Industrial Espionage Malicious Acts Pranks Natural Disaster Sabotage User Error Threats Public, Partner, Legislativ e Trust Lost Critical Operations Halted Sensitive Data Disclosed Services & Benefits Interrupted Assets Lost Potential Damage [the Agency’s] [the Agency’s] Systems Enterprise Security Risks Failed CFO Audit

8 Why is Security Important to [the Agency’s] ?  Protect privacy information  Protect processes and corporate assets  Provide continuity of services  Provide accessibility of information It is a prudent business practice to reduce risks to [the Agency’s]

9 Why is Security Important to US? Each One Of Us Is Accountable!

10 Laws and Regulations  Computer Security Act of 1987  Privacy Act of 1974  Freedom of Information Act  Presidential Decision Directive (PDD) 63  OMB A-130, Appendix III, Revised  Health Insurance Portability and Accountability Act  FISMA of 2002

11 Audit’s Point of Weaknesses  General Accounting Office  Internal Revenue Service  Office of the Inspector General  Chief Financial Officer  Office of Information Services

[the Agency’s] Enterprise Security Program Policy, Training, Engineering, and Management Oversight for [the Agency’s] all [the Agency’s] employees, contractors, and agents

13 Security Program Elements  Personnel and Physical Security  Security Awareness, Training, & Education  Risk Management  Integrating Security into the SDLC  Security Determinations and Requirements  Security Plans & Certification  Systems Access Security  Acquisitions & Contracts  Remote Access Security  Audit Systems  Business Contingency Planning  Workstation Security  LAN Security  Security Incidents  & Facsimile Security  Internet / Intranet Security  Virus Prevention, Detection, & Reporting  Medicare Contractor Oversight

14 Current Enterprise Security Initiatives  GPRA Goal of Zero Material Weaknesses for the Year 2000 and Beyond  [the Agency’s] Enterprise Security Handbook  Information Technology Architecture  IT Council Security Committee  HIPAA Compliance

15 Immediate Next Steps  Designation of Information Systems Security Officers  Re-certification of User Access Privileges  Corrective Action Plans to Audit Findings  [the Agency’s]  [the Agency’s] Contractor Oversight  Security Awareness and Training

16 Summary  Recognize that security risks in [the Agency’s] environment impact [the Agency’s] Mission.  Security is a management responsibility.  Security is everybody’s business.

17 We ask you to:  Encourage and support [the Agency’s] security initiative activities!  Lead by example!  Be proactive!

Thank You