Evaluating Legal Ethical & Regulatory Concerns in Organizations Essay – Description
Evaluating Organizational IT Policy for Compliance
LESSON INTRODUCTION
With the introduction of computers and networks and the evolution of new technologies like Artificial Intelligence (AI), mobile and cloud computing, and social media, the foundation and organizational structure and dynamics of IT strategy and policy went through an extreme transformation. The Internet of Things (IoT) adds the connection of nontraditional computing devices to networks like: cars, home appliances, cameras, drones, etc. As these developments and additions contribute to providing more accessibility and versatility, they also present a wide variety of risks that must be managed and controlled to prevent exposure, data compromise or corruption, and even disasters. As enterprises and organizations expand their operations, locations, and network connections, more risks arise that threaten the integrity and health of transactions, operations, and data integrity. Therefore, it is essential to have a sound security strategy in place to support the corporate strategic plan. Risk management is an integral part of the corporate security plan to guarantee integrity and privacy of data, databases, applications, and perimeter protection, both internal and external.
An organization’s risk management style stems from its approach to business, mission, long-term strategy, and goals. Although risk management is not just an effective business practice, it is also imposed upon it as a matter of law. The ability to manage risk comes from different governance strategies as well as a mandate. Laws, regulations, and statutes; such as SOX and Health Information Portability and Compliance Act (HIPAA), are certainly included in governance, but they should not be the only measures taken. Policies and procedures are also considered rules of governance. A risk manager should recognize the many regulations and policies that dictate an organization’s approach to risk management.
Some of the most prevalent statutes in the IT world are the Federal Information Security Management Regulations (FISMA). The requirements that FISMA applies to all US agencies apply to all federal systems, as well. It also requires each agency to establish and maintain a risk management and information security program and produce annual reports on their results (CISA, n.d.). According to whether it is being used as a formal program or informal tool, it varies from agency to agency. One possible example of this is that the U.S. Department of Defense made FISMA a vehicle for IT risk management in 2006, but subsequently replaced it with NIST’s Risk Management Framework in March of 2014. In essence, the Risk Management Framework (RMF) includes an agency risk management process that should be utilized in all federal organizations (NIST, 2020). Regardless of the market or segment your organization works in, risk management will likely be required. If your organization is a federal, healthcare, or financial agency, you must follow federal requirements.
References
Cybersecurity & Infrastructure Security Agency. (n.d.). Federal information security modernization act. CISA. https://www.cisa.gov/topics/cyber-threats-and-advisories/federal-information-security-modernization-act#:~:text=FISMA%202014%20codifies%20the%20Department,OMB%20in%20developing%20those%20policies.
National Institute of Standards and Technology. (2020). Security and privacy controls for information systems and organizations. NIST Special Publication 800-53, Revision 5. https://csrc.nist.gov/publications/detail/sp/800-5…
Evaluate Legal, Ethical, and Regulatory Concerns
INSTRUCTIONS
BACKGROUND
In risk management activities, including legal and regulatory requirements, you should work with your organization’s legal and management departments. You should also check to determine if there are any additional requirements imposed by your clients or by a third party. It is important to consider the various risk factors and vulnerability assessment requirements when designing an information security program. As a risk manager, the objective is to inform the creation of an improved approach to cybersecurity within the organization.
INSTRUCTIONS
For this assignment, you will write a paper that evaluates legal, ethical, and regulatory concerns including the adoption of new technologies. Consider offerings from FISMA, NIST, ISO, ISACA, etc.
Be sure your paper includes discussion of the following topics:
Legal, ethical, and regulatory concerns, including the adoption of new technologies.
Assess policy implementation, maintenance, and contingency aspects of your selected case study for risk, controls, threats, and maturity models.
Craft a high-level research question with 5-7 supporting sub-questions. Propose methods for investigating questions (either qualitative or quantitative) and provide a brief ethics statement. All research questions should consider research ethics within the context of your identified problem domain.
Reference
https://www.ffiec.gov/cyberassessmenttool.htm
https://projectresources.cdt.ca.gov/
https://aset.az.gov/policies-standards-and-procedu…
https://www.congress.gov/bill/107th-congress/house…
https://nj.gov/it/whatwedo/sar/
https://nj.gov/it/whatwedo/tpu/
https://www.axelos.com/resource-hub/case-study/spo…
https://projectresources.cdt.ca.gov/agile/
The post Evaluating Legal Ethical & Regulatory Concerns in Organizations Essay first appeared on .
