信息安全治理和风险管理教材.pptVIP

信息安全治理和风险管理Information Security Governance and Risk Management CISSP第六版培训课件之一 关键知识领域 A. Understand and align security function to goals, mission and objectives of the organization 理解安全功能并将其与机构目标、使命和宗旨相结合 B. Understand and apply security governance 理解并运用安全治理 B.1 Organizational processes (e.g., acquisitions, divestitures, governance committees) 组织过程（如收购、分拆、治理委员会） B.2 Security roles and responsibilities 安全角色与职责 B.3 Legislative and regulatory compliance 法律和监管的合规 B.4 Privacy requirements compliance 隐私要求的合规 B.5 Control frameworks 控制框架 B.6 Due care 尽职关注 B.7 Due diligence 尽职调查 关键知识领域 C. Understand and apply concepts of confidentiality, integrity and availability 理解并运用保密性、完整性与可用性的概念 D. Develop and implement security policy 制定并施行安全政策 D.1 Security policies 安全政策 D.2 Standards/baselines 标准/基准 D.3 Procedures 程序 D.4 Guidelines 方针 D.5 Documentation 文件编制 E. Manage the information life cycle (e.g., classification, categorization, and ownership) 管理信息的生命周期（如分类、归类与所有权） F. Manage third-party governance (e.g., on-site assessment, document exchange and review, process/policy review) 管理第三方治理（如现场评估、文件交换及审查，过程/政策审查） 关键知识领域 G. Understand and apply risk management concepts 理解并运用风险管理的概念 G.1 Identify threats and vulnerabilities 身份识别的威胁与漏洞 G.2 Risk assessment/analysis (qualitative, quantitative, hybrid) 风险评估/分析（定性型、定量型、混合型） G.3 Risk assignment/acceptance 风险分配/接纳 G.4 Countermeasure selection 对策选择 G.5 Tangible and intangible asset valuation 对有形资产和无形资产的评估 H. Manage personnel security 管理人员安全 H.1 Employment candidate screening (e.g., reference checks, education verification) 求职者甄选（如证明人核实、教育背景查证） H.2 Employment agreements and policies 雇佣协议与政策 H.3 Employee termination processes 员工解雇流程 H.4 Vendor, consultant and contractor controls 销售方、顾问与承包商控制 关键知识领域 I. Develop and manage security education, training and awareness 发展并管理安全教育、安全培训与安全意识 J. Manage the Security Function 管理安全功能 J.1 Budget 预算 J.2 Metrics 衡量标准 J.3 Resources 资源 J.4 Develop and implement information security strategies 开发并实施信息安全策略 J.5 Assess the