2022-077-E-IT Dept-PUBLIC LIBRARY ASSOCIATION, a divison of the American Library Association-Digital learning

Browse Search

DocuSign Envelope ID:24BBAFA9-CD81-4144-ACEF-E9036E703739 The CISO is responsible for establishing a monitoring and reporting program that contains the following: • Security Monitoring • Internal Testing • External Examination Risk Management Reviews The Security/IT Steering Committee and Board of Directors of Jende Solutions continuously strive to maintain a clear understanding of the types of information security risks to which Jende Solutions is exposed. This is accomplished by: • Delineating clear accountability and lines of authority across Jende Solutions's businesses and information security activities. • Conducting an annual review of threats and hazards to critical operations and adjusting the information security program accordingly. • Maintaining an active oversight role as products, services, and new technologies are instituted and improved. • Providing clear guidance regarding acceptable levels of security over Jende Solutions's information assets. • Ensuring that the established policies, procedures, and controls are communicated to and observed by all employees. • Annually reviewing and approving information systems and security policies to ensure that the policies address security risks, are aligned with Jende Solutions's overall business and technology strategies, and comply with relevant laws, regulations, and rulings. • Performing an annual review and approval of the internal audit program for scope and frequency concerning compliance with information security policies. Security Monitoring The CISO is responsible for coordinating the monitoring program for all information systems activities and reporting any significant violations to company policy to Senior Management and the Security/IT Steering Committee. This includes oversight of the following duties: IT Department Responsibilities • Perform a periodic review of all systems management logs, system/application activity reports, and disk usage to search for possible security incidents. If a possible intrusion is identified, implement procedures as outlined in the Incident Response Policy. • Perform all scheduled maintenance to include software updates and maintain a log of services performed. • Perform an annual audit of all systems, software and peripheral devices to ensure an accurate software and hardware inventory. • Immediately remove any unlicensed software, hardware, or unauthorized modems from the network or any system. • Periodically review and clear error logs. • Review media backup and anti-virus logs daily to ensure that no viruses are detected and that the data was successfully backed up the previous night. • Periodically review user and group security profiles. This includes reviewing user access to systems and data based upon their business responsibilities, granting access rights based upon these job functions, and ensuring security profiles are promptly modified or revoked upon a change in job function or termination. For each audit entry, the following information will be recorded: ■ Date and Time of event ■ User ID and User involved in the event ■ Type of User action