Planning

// REQUIREMENTS

// INTENT

The system security plan exists, describes the real environment and boundary, and gets updated when the environment changes; rules of behaviour for users are written down.

// WHAT A FIRST ASSESSMENT FINDS

No SSP, or a template one describing a company that doesn't exist.

// THE WORK

Write the SSP skeleton first (Chapter 9), have users sign rules of behaviour on hire and annually, and wire the review trigger into change control.

// HOW WE CAN INTERPRET IT

// TEMPLATES FOR THIS FAMILY

• System security plan outline
• Acceptable use policy Build it in the policy builder
• Policy inventory checklist