Lowe’s Certification and Accreditation

 Systems Boundaries and Functions  Vulnerabilities, Threats, and Threat Sources  Annual Loss Expectancy  Identification of Mediating Controls  Appropriate Effectiveness for each Vulnerability  Plan of Action and Milestones

 Purchase and Return Records Sales system  “Pick up Later” System Documentation of product  Inventory System Responsible for updating inventory  Management and Security Review End of the day reports

System Structure

 Tornado Action Plan Lock all doors Move all associates and customers to back of store  Flood Action Plan  Built in drainage in parking lot  Store built on a hill  Products and computers/servers lifted off ground  Appropriate Effectiveness Measurements  ALE = ($660,000 = $16,500,000 AV x 1.0 EF x.04 ARO)

 Employee are Required to Wear Uniforms Vest stay in store Store Number Associated with Computer Logins Appropriate Effectiveness Measurements ALE = ($26.88 = $960 AV x 1.0 EF x.028 ARO)

 Back Up Generator Required fuel level Plan in place if needed longer than 8 hours Appropriate Effectiveness Measurements ALE = ($1500 = $50,000 AV x 1.0 EF x.03 ARO)

 Pen and Paper Inventory System Departments manually count inventory Employees  Employees are trained to watch for any UPC occurring in the store  Appropriate Effectiveness Measurements  ALE = ($12,500 = $500 AV x 1.0 EF x 25 ARO)

 Exterior Doors are Locked  Cameras on Inside and Outside of Building Footage stored for a length of time Lumber Yard is Secured  Entrance patrolled by employees  Each transiting through is checked  Server Room is Locked with Key Code  Appropriate Effectiveness Measurements  ALE = ($800 = $4,000,000 AV x.001 EF x.20 ARO)

 Data Securely Transferred Between Stores Different encryption methods used for transfer Logins Required to Access Customer Data Appropriate Effectiveness Measurements ALE = ($25,000 = $250,000 AV x 1.0 EF x.1 ARO)

 Video Cameras Placed above registers, exits Register Tills Counted Checked by hand and computer  Inventory Monthly inventory is checked against current sales Appropriate Effective Measurements ALE = ($225 = $25 AV x.75 EF x 20 ARO)

 Industry Standards in Place System is in accordance with PCI DSS standards Vulnerability Software Nessus checks for any vulnerabilities on the card reader system  Appropriate Effective Measurements  ALE = ($14,000 = $2,000 AV x.70 EF x 10 ARO)

 Fire Detectors and Water Sprinkler Systems Installed  Security Cameras Inside and outside placement Watched by asset protection employee Appropriate Effective Measurements ALE = ($412,500 = $16,500,000 AV x 1.0 EF x.025 ARO)

 Sufficient Documentation Required be Provided to Customer on Policies  14 Day waiting on Checks to Clear  Appropriate Effective Measurements  ALE = ($50 AV x 1.0 EF x 70 ARO)

 Write a “what to do” for an Earthquake Earthquakes are minor in Oklahoma, however this is something that should have an emergency plan for.  Make Employees More Aware of Policies Electronic training be associated with the employees during their hire dates.

 Systems Boundaries and Functions  Vulnerabilities, Threats, and Threat Sources  Annual Loss Expectancy  Identification of Mediating Controls  Appropriate Effectiveness for each Vulnerability  Plan of Action and Milestones