You work for a large, private health care organization that has server, mainframe, and RSA user access. For the third week in a row, Sean comes into your office at 5:00 p.m. on Friday and needs you to write a report describing some of the risks associated with not having all the security items in place. He needs you to research a generic risk management policy template and use that as a starting point to move forward. He also asked you to search for risk outcome examples from organizations similar to theirs.

INFS 6840 & 3223: IT Governance

Assignment 3: 40 points

The purpose of this assignment is to apply RISK management concepts that you read about in chapter 5.

Scenario

You work for a large, private health care organization that has server, mainframe, and RSA user access. For the third week in a row, Sean comes into your office at 5:00 p.m. on Friday and needs you to write a report describing some of the risks associated with not having all the security items in place. He needs you to research a generic risk management policy template and use that as a starting point to move forward. He also asked you to search for risk outcome examples from organizations similar to theirs.

The task is due over the weekend.

You realize that your organization does not have much in the way of an information security strategy, and is missing many of what you think are critical components. Your organization is compliant with the Health Insurance Portability and Accountability Act (HIPAA) and follows other external compliance requirements.

Assignment Requirements

Research templates and look for risk outcome examples from organizations of a similar type as your organization. Write a report identifying the risks associated with the current position your organization is in and how your organization can mitigate risk by using information security systems policies. Include an introduction explaining the following: Who? What? When? Why? Be sure to add a conclusion with a rationale detailing how risks can be mitigated. Please link your analysis with the COBIT framework that we have discussed in class.

Reference your research so that Sean may add or refine this report before submission to senior management.

Prepare a report about the company’s security program status. Your report should be at least 800 words (1-2 pages) and should have at least 5 citations beyond the textbook.

Rubric:

Addresses each quadrant: 10 points

Rationale for your argument to include items in each quadrant: 15 points

Met word count: 5 points

Included 5 citations: 5 points

Gone beyond the requirement of the assignment (additional information that makes your submission stronger): 5 points