ࡱ > e [8 bjbj | xj\xj\M0
f f 8 * | 2B B z K D _ $ A A A A A A A $ D F A ) " K A m A %" %" %" F A %" A %" %" = @ 0$ X w> A B 0 2B > xG ! xG 4 @ @ & xG 9@ d %" A A 2B xG f > :
Written Information Security Policy (WISP) Template
Copyright 2009 ComplianceHelp.Net:: This material is copyright protected and cannot be copied or used except as authorized in the attached license. Please see the attached license. Warning: The unauthorized reproduction or distribution of this copyrighted work is illegal. Criminal copyright infringement, including infringement without monetary gain, is investigated by the FBI and is punishable by up to 5 years in federal prison and a fine of $250,000.
Instructions:
Answer the 8 questions and the WISP will be automatically generated on the following pages. Then simply review, print out, and sign the WISP.
What is your company name? FORMTEXT [Your Company Name]What is your address (without ZIP)? FORMTEXT [Your Company Address Here]Who will be in charge of your Information Security Policy?
201 CMR 17 requires that you designate one person to be in charge of security. FORMTEXT [Security Coordinator's Name]Please list locations where you might store Personal Information.
Please use a comma-separated list like the example. FORMTEXT [ Filing cabinets, servers, and desktop PCs ]How frequently does your IT administrator audit server logs for evidence of breaches? (in days)Every FORMTEXT 30 daysHow frequently does your IT administrator install operating system security patches?Every FORMTEXT 30 days.What type of firewall do you use?
Example: SonicWall, Juniper, or Cisco. FORMTEXT [Firewall brand here]What Antivirus software do you use?
Example: Symantec Endpoint Security FORMTEXT [Antivirus brand here]
Note: If you would like to further edit the WISP, go to View -> Toolbars and check off the Forms toolbar. Then, click once on the lock icon that appears in the new toolbar. If you are using an older version of Microsoft Office, you may need to manually fill out the template with your information instead of using this form.
Written Information Security Program
TIME \@ "M/d/yyyy" \* MERGEFORMAT 7/26/2018
Prepared by:
REF securitecoordinator \* MERGEFORMAT [Security Coordinator's Name]
SENSITIVE INFORMATION NOTICE: THIS PLAN CONTAINS SENSITIVE AND PROPRIETARY INFORMATION ABOUT REF CompanyName \* MERGEFORMAT [Your Company Name] BUSINESS PROCESSES, CLIENTS, AND SECURITY PROCEDURES. ACCESS TO THIS PLAN WILL BE RESTRICTED TO REF CompanyName \* MERGEFORMAT [Your Company Name] EMPLOYEES ONLY.
Objective
In order to protect our clients privacy and personal information, we at REF CompanyName \* MERGEFORMAT [Your Company Name] have developed this Written Information Security Program. This is a comprehensive set of guidelines and policies we have implemented in compliance with Massachusetts General Laws 201 CMR 17 Standards for The Protection of Personal Information of Residents of the Commonwealth, as well as other federal, state and international regulations and standards. This plan is reviewed periodically and amended as necessary to protect personal information.
Designated Employees to Maintain Security Plan (201 CMR 17.03(a))
At REF CompanyName \* MERGEFORMAT [Your Company Name], we have appointed REF securitecoordinator [Security Coordinator's Name] to be the designated employee in charge of maintaining, updating, and implementing our Information Security Program.
Internal and External Risk Assessment (201 CMR 17.03(b))
In order to assess any risks of access to personal information, we have evaluated where that information may be present. REF CompanyName \* MERGEFORMAT [Your Company Name] may keep information or other sensitive information on our REF PIlocations [ Filing cabinets, servers, and desktop PCs ] which are password protected and locked. Our internal computers are protected behind a firewall.
REF CompanyName \* MERGEFORMAT [Your Company Name] Employees may from time to time need access to personal information. In order to insure that none of this information is vulnerable to a breach, we have implemented the following policies:
Employee Training (201 CMR 17.03(b)(i))
All employees are responsible for maintaining the privacy and integrity of personal information. Any paper record containing personal information about any client or third party must be kept behind lock and key when not in use. Any computer file containing personal information will be kept password-protected. No personal information is to be disclosed without first fully authenticating the receiving party.
When disposing of paper records containing personal information, a cross-cut shredder or outside shredding service will be used. Similar appropriate electronic methods will be used for disposing of electronic media.
REF securitecoordinator [Security Coordinator's Name] trains all new employees on this policy, and there are also periodic reviews for existing employees.
Employee Compliance (201 CMR 17.03(b)(ii))
Any employee who discloses personal information or fails to comply with these policies will face immediate disciplinary action including the possibility of termination.
Detecting and Preventing Security System Failures (201 CMR 17.03(b)(iii))
REF CompanyName \* MERGEFORMAT [Your Company Name] will provide regular network security audits in which all server and computer system logs are evaluated for any possible electronic security breach. These audits will be performed every REF Auditdays 30 days. Additionally, all employees are trained to watch for any possible physical security breach, such as unauthorized personnel accessing file cabinets or computer systems.
Keeping, Accessing and Transporting Personal Information (201 CMR 17.03(c))
As mentioned above, REF CompanyName \* MERGEFORMAT [Your Company Name] will take all possible measures to ensure that employees are trained to keep all paper and electronic records containing personal information securely on-premises at all times. When there is a need to bring records containing personal information off-site, only the minimum information necessary will be brought; electronic records will be password-protected and encrypted, paper records will be kept behind lock and key. Records brought off-site should be returned to the REF CompanyName \* MERGEFORMAT [Your Company Name] office as soon as possible.
Under no circumstances are documents, electronic devices, or digital media to be left unattended in an employees car, home, or in any other potentially insecure location.
Disciplinary Measures (201 CMR 17.03(d))
Any employee who willfully discloses personal information or fails to comply with these policies will face immediate disciplinary action including the possibility of termination.
Prevention of Terminated Employees from Accessing Information (201 CMR 17.03(e))
Any terminated employees computer access passwords will be disabled before the employee is terminated. Physical access to any documents or resources containing personal information will also be immediately discontinued.
Third-Party Service Providers (201 CMR 17.03(f))
Access to personal information by third-party service providers will be kept to a bare minimum. Any third party service provider who does require access to information will be fully vetted.
Limiting Information Collected (201 CMR 17.03(g))
REF CompanyName \* MERGEFORMAT [Your Company Name] is committed to collecting only the minimum of personal information necessary to accomplish our purposes; old information is also disposed of securely after 7 years or after whatever period is required by federal and state data retention requirements.
Identifying Where Personal Information is Stored (201 CMR 17.03(h))
We have identified the locations where personal information is stored on our network. Personal information is stored in the following: REF PIlocations [ Filing cabinets, servers, and desktop PCs ].
Physical Access Restrictions (201 CMR 17.03(i))
REF CompanyName \* MERGEFORMAT [Your Company Name] offices and computer network are kept locked third-parties are not allowed physical access to records. Paper files that are not currently in use are kept locked in filing cabinets. In addition, electronic records are kept in databases and on servers which are behind multiple layers of electronic safeguards.
Monitoring and Upgrading Information Safeguards (201 CMR 17.03(j))
REF CompanyName \* MERGEFORMAT [Your Company Name] appointed information security coordinator, REF securitecoordinator [Security Coordinator's Name], will continually monitor and annually assess all of our information safeguards to determine when upgrades may be necessary.
Annual Review (201 CMR 17.03(k))
REF CompanyName \* MERGEFORMAT [Your Company Name] appointed information security coordinator will also perform an annual review of our information security plan.
Documenting and Reviewing Breaches (201 CMR 17.03(l))
REF CompanyName [Your Company Name]s information security coordinator will thoroughly document and review any breach that may occur. Records of this will be kept on file with our Written Information Security Plan.
Computer System Requirements (201 CMR 17.04)
To combat external risk and security of our network and all date, we have implemented the following policies:
Secure user authentication protocols:
(201 CMR 17.04(1)(i, ii, iii, iv, v))
Unique strong password ds are required for all user accounts; all employees receive their own user accounts.
Passwords are changed on a regular basis
Accounts are locked after 3 successive failed password attempts
Any terminated employees computer access passwords will be disabled before the employee is terminated.
b. Secure access control measures: (201 CMR 17.04(2)(i, ii))
Only Employees that need access the personal information are given access to proper folders
Each person has a unique password to the computer network. These passwords are not assigned by any vendor.
c. Encryption on Public Networks
(201 CMR 17.04(3))
We do not transmit unencrypted Personal Information across public networks under any circumstances.
d. Reasonable monitoring (201 CMR 17.04(4))
REF CompanyName \* MERGEFORMAT [Your Company Name] performs a network security log audit every 30 days in order to detect any possible breaches.
Laptops and Portable Devices
(201 CMR 17.04(5))
Any laptop or portable device which has personal information stored on it will be kept encrypted using a whole-disk or whole-device encryption solution at all times.
Security Updates and Patches: (201 CMR 17.04(6))
We use the REF Firewallbrand [Firewall brand here] business class firewall and it is regularly monitored. Operating system patches and security updates are installed every REF Patchdays 30 days to all of our servers.
Antivirus and Updates(201 CMR 17.04(7))
We use the REF Antivirusbrand [Antivirus brand here] Antivirus software and it is kept updated on all servers and workstations. Virus definition updates are installed on a regular basis, and the entire system is tested and checked at least once per month.
Education and training of employees on the proper use of the computer security system and the importance of personal information security. (201 CMR 17.04(8))
All employees are responsible for maintaining the privacy and integrity of personal information. All employees have been trained that any paper record containing personal information about any client or third party must be kept behind lock and key when not in use. Any computer file containing personal information will be kept password-protected. REF securitecoordinator [Security Coordinator's Name] trains all new employees on this policy, and there are also periodic reviews for existing employees.
XV. Effective Date (201 CMR 17.05)
Reviewed by _________________ on the date: ____________
Employees, by signing below, you assert that you have read this Plan and will comply with its requirements:
Name Date
Name Date
Name Date
5 6 7
l
m
n
ϽtibTiKibt hM mH nH uj h'! h5s U h'! h5s j h'! h5s Uh* h5s 5CJ aJ h= 6CJ aJ h 6CJ aJ h2P 6CJ aJ hu h 5hu h6x 5#h B*CJ OJ QJ ^J aJ ph #h6x B*CJ OJ QJ ^J aJ ph hu hu 5h6x 5CJ$ aJ$ h 5CJ$ aJ$ hc 5CJ$ aJ$ j hc UmH nH u 6 7
h$If ^hgd*
& F
$If gd* $a$gdu $a$gd
1 v i \
h$If ^hgd*
& F
$If gd* kd $$If l 0 >& v
t 0 ?*6 4 4
l a4p yt* / 0 1 l o - . c d e o p q un`uTu h'! hc mH nH uj h'! hc U h'! hc j h'! hc UhM mH nH uj hM UhM j hM Uh* hM@l 6CJ aJ h* hM@l 6h* hM@l 5CJ aJ h* h5s 5CJ aJ h'! h5s h'! h2P mH nH ujI h'! h2P U h'! h2P j h'! h2P U 1 2 n o v i \ \ \
h$If ^hgd*
& F
$If gd* kd $$If l 0 >& v
t 0 ?*6 4 4
l a4p yt* . / d v i \ \ \
h$If ^hgd*
& F
$If gd* kdd $$If l 0 >& v
t 0 ?*6 4 4
l a4p yt*
v i \
h$If ^hgd*
& F
$If gd* kd $$If l 0 >& v
t 0 ?*6 4 4
l a4p yt*
s
y
z
& ջջ皒~sj h. mH nH uj h. Uh. j h. Uh* hV 6h* hM@l 6h* hM@l 5CJ aJ j h'! hc U h'! h5s h'! hc mH nH uj h'! hc Uj h'! hc U h'! hc h* h5s 5CJ aJ h* hc 5CJ aJ $
s
v i \
h$If ^hgd*
& F
$If gd* kd $$If l O0 >& v
t 0 ?*6 4 4
l a4p yt*
v i \ \ \
h$If ^hgd*
& F
$If gd* kd' $$If l O0 >& v
t 0 ?*6 4 4
l a4p yt* ' ( L q v i \ \ \
h$If ^hgd*
& F
$If gd* kdx $$If l 0 >& v
t 0 ?*6 4 4
l a4p yt* & ' L M W X Y o p q r s " " # zqzbzYH j hM hn& 5CJ$ UaJ$ h 4 5CJ$ aJ$ h6 i 5CJ$ aJ$ mH nH u h 5CJ$ aJ$ j h 5CJ$ UaJ$ h 5CJ$ aJ$ h h 5CJ$ aJ$ h6x 6CJ aJ hu 6CJ aJ hM@l 6CJ aJ h h 5CJ aJ h'! h2P h. mH nH uj h. Uh. j h. Uh* hM@l 6h* h2P 5CJ aJ q r s " v m a a Y T T L $a$gd gd 4 $a$gd $h^ha$gdn& h^hgd kd $$If l O0 >& v
t 0 ?*6 4 4
l a4p yt* # M N k l m p t
j k l ~ ĻСtСhd\WO h hZ 5 h 5h h 5h h h
5CJ$ aJ$ h h
5CJ$ aJ$ hWr 5CJ$ aJ$ hM h 5CJ$ aJ$ hM hWr 5CJ$ aJ$ j hM hWr 5CJ$ UaJ$ h 4 5CJ$ aJ$ h
5CJ$ aJ$ hM h
5CJ$ aJ$ "hV hV 5CJ$ aJ$ mH nH u j hM hn& 5CJ$ UaJ$ hM hn& 5CJ$ aJ$ " m n o p q r s t u N O P Q $h`ha$gd'#` h`hgdZ h`hgd h^hgdZ
& F gd gd $a$gd 2 3 F G H L : M N O R S u v P Q v ' ( ; < کҚښҏtmtt h'#` h'#` j h'#` h'#` U h'#` hd hd hd 5 hZ h
h 4 j h 4 U h'#` hWr j h'#` hWr U h'#` hZ hZ 5 h 5 h/c4 5h h 5hZ hWr hV mH nH u hWr hWr j hWr hWr U hWr h h *Q = > X Y Z [ \ 1 3 }
& F gdZ 8^8gd/c4 h^`hgdpU h`hgd= h`hgdtFV 8^8gdpU
& F gdd h`hgdd h^hgdd
& F gd < = @ F Q x y ? @ S T U ^ & < = > X [ \ o »²᪈ hpU hpU h j h'#` U hpU 5 h/c4 5 hd 5 hd hpU hpU hd hV mH nH u h'#` h'#` j h'#` h'#` Uhn5 hX h'! hV mH nH uh= j h= Uh- h
h'#` h
h'#` 2o
2 3 d | } ~ M r s $ , 6 7 8 p ʺʶ쮦ᕐ{pi hl hl j hl hl U hl h%w7 h%w7 h}3f 5 h%w7 5 htFV 5 hpU 5h'! hV mH nH uj h= Uh= h h; hV mH nH u h; h; j h; h; U h; hpU hZ 5 hpU hpU h41 hpU h/c4 5 hd 5 hux 5 )} ~ 7 8 ! ! ! ! " " " " " # # # # h`hgdR= h^hgdR=
& F gdR= h^hgd%w7 h`hgd@]k gd%w7 h`hgd%w7 h^hgd}3f
& F gdtFV h`hgdtFV 8^8gdpU ' > ? H N ! ! ! ! ! ! d" g" " " " " " " # # # # # # # # $ $ $ $ $ $ ܴئ| hR= ht h
ht hR= hR= hw hR= hR= 5 h@]k h@]k h@]k h%w7 5 htFV 5 h%w7 h/c4 hV hl hl h" h%w7 h" h" h[^m h[^m h%w7 hl h%w7 hl hV mH nH uj hl hl U 0# # # # # $ $ $ $ $ (& )& m& n& <' =' >' n' o' ( ( gdPDPEb1Dss4-yV$?גo4&JiJF(ժÑz}NGiokinjkn&MDV<:o( ظ #0$} ėf1Vc˵Y-e&f5YШufUU)\O$U"` Ry>s@@0`#JR+U`)rzξ YO><
0&8C\ছ
JewzzzۻvN+((ȵz^UkQsAuZN
FQ=X`4x rb1EYT>VF`$ 1u$) xoǎtڡj+K
F#( 6 1h#
z)rZA F.j+&jV 5R2o'>Ch* 7?C#0DG_N*w8]S
G
*nj:ē p$i5e%3*b`*"q_LPTJΨmM&ccJ
KJA)!"` x8fl `6}\/8KGX[w55 =ML JN h6UT괂R@>
`
j^
22
*bX:i8 ic`I`i ,@f #b(:}zΝ kpD@.
2
&%xƦ={j;VA̠lB9#isLFЏ 2S 1J=hL >J TJZjÁ)/{VRAR xdyk`^#p! R9y`ē
&:h81@8 @` l-` %
*QUĔ1EDАlTbpDCҁ~?\ߨܳ_kjm
iTU4> dF@af/ |l cP R9~Xg61YG8:c@FڤSB $0or[4c:ڝЌjZ{;v{Ixv 9z)J;D#`-n`}/wZ~x! G"\\FP$*ӛ`^֩Á0y?R{ }L"s9 &4n%
9j1),9㝡'DyU6+H #=何KBD|ʫfM;\pC#*JFs'$-="^0.r hj(v[ IE,jEYY8fe4嘜&I7xjٍ̔ gV<+G`! {ٳ 1<>P3ŖTDfp"l+mcGs?"2',9\?7n_ ^2c HBAv8
#iA@F4X#1@?JL0(PQ6b{%͗,.?k曳)N¦( QMfv] QM!UM6Zퟁm "Ey^ /8K¾ GׂV\є?\vAV0 FArMm6x6Oq'PWԷwvvAF|)")|yg8" Zχ
$z#
1I &Bq&ȮCr,DN0
{:@ʑRĔ(G! Sf^#pL! a 1rB_*Dua`D Cu,?IZAOWD&Gr2RNj:L EA2F%!.dQFHP m!µ &. 5
` l0Ip^0zY "~L8*&;K>Ps; 7bEyX0s _@ <|0 #f&J3uZ}a-U;4 [9 W,ԛM0Fᨨ3nR O464{q@N}q0
睖k1#fm #mmN-|,STB$X"(m N (<l8;đAτ
io0v"Gca.(cEy"%+.[(6]1eh3[Wl/ds
B>qZ0O a@$D8%1G CYENqc2;
y=K7N5NR.@EB<"y # !JP"> h=CC 2X :6((t6& 1,@ĚBܓd x8f{iaU
5PK V1=X63] H)54?M$JL2e8*2
-?v{yE?XOX;w'W}1JC$`1=Q`#]j$ .rc #acC=|PD"!0Tby')0 *I& I\v'ɸ=ٹ>z_]\ WD|ab/VX34,t])!\wy?9@v$Et DfqT)Xc!ۋA&xjE*1a
۱ջzor˭b1rX)Ntgqw}k P4r23eV^='Nx7O?kHUS=OP6=
ږ&C {b;e EFR؋e2tFc6{v"T vgYV
9sƇ ~t~vǝyُ=lv%YG8dGB
?頵${]1A$g4ș[ 3|dTRу b'%_,Y2k{gCk3`HGB
i+eDţ#!\ `:֒ O(Dfa>E7ʆ\R B^aߩӲRx!;cc^-9햾 %;J?r/8IaKvU㫓s-sHA`(I<
"D TpSq#CHg' >%J=.XA; -Xmg[gQ!AoHxdeo: #mG= e $ ֦F&!6>whYVA Xkf+ Svd2yh*Pkp*F.xH)U9;]Nl7VNf}E4_^mRA(? lg;?O% IQ>="|:~h]]=FO(MjvwWKwg[V5]?R|!B8)'`D~cSsryw2R0VY,jcJ͛ө c!Q p
0,/i&|47->nJǘqϻ"ޅ c|&͗6R{TK#-sDB?Pղ.ג_smP?V$ xXc1tg&s+E_ ( a,J=*erK".~JgNHx 3\K+W׳<䤖\sPxΜR`` 6oJr.Ƅ{jjfL&@k* {)J]YO\sM@2%nPX||B{0.9O(5 ᥨmfI6xl
l O\=mo ȇ@=&Ƨ'u{:txГ!4518#]l)2ɬ3v1_e%g͚%<#3JZX&.~#&0`#
^]v1HW_,O,]Jar>6ֶv@ܹlP,2'5NϚ{LR.Ib: 8| ?@ە8j QsRZ̃-RbHvJ7jI&!N%$+E
$ApOX=z= x>@6#X8OhB4 _/>6~LnU
kK`݁rTgV@6}{ ,ܠDŬN?h1joRRN&c0Xosg̈́ / lh($ ㉗ LR.>`s5O4XQ`
:ܫI= FRpF썺G=gA>Q@4;~;
睻i*쫁}Bdn%yXbjsr73~KreD~2F WIfj<%߿
`d++9~ D!9u҉BDŠLƫVI | HRYS dGJOF8k}{kЋBvI
1Џ QGŇ~Q#б}߸kKol¨?RJګ^y4_]jBK:JnX\<3í[Q,
4)S嘱' %F h:$j |8_A? dJ e(,x5R*:NRYS $\W«L>" ll~U>J R@j= J<ā;xNӵ~~/kem 0GCS;>6.c 8=k4'hL9&cB< 6WA:.t^ r+>b|{'
w J.!~xO'?g2%!C2;=UUU5BzrVN2߸ -B?H`Hza jA2pZ@B)e qVPwFD:F۷-^WU 1b s#z=%P g3*(HF( O}Vۨ_-עvqgJXᑇlY=2Ƅ=4!l|JG!9It_ ׯ~Wbq|^{]V |ofꛗ.0Zyeus+/ $ l۲lF
W![1@4Pї=Ε$~ňlx#Fn 9`xb_ Ƅ8 ֯[N J?@ߺ m
1*IAIs$IۖRŪSB NOICZ)2aD9b!Óm 0/C(A? uO-N}A}A(e]> J 9[!2)m#J-|my'Na "UA
zl7EՊ8%z98)eJ$6U%7sRV6hn{Vj \gMw.[n
tͶsΜ'M$mE_u˖n-,PR
W[N7&JyPn^vh(7S? 3Z_͛ɴ)y#3=[^x!"P%߁Fx4jÀyYk^xkzڵ,o^{;r B OhqEҥK7w2p7q:%5AlBa9*.-k ffɭ?Nছ xa zmev[O+W:bT%g`Cw;Vv?\|%؆&0+ĔcAF"")!ZObQNȏΤ2)_bSM
o$$*/JR\2%ėA F @ak颥[N\)L5Psr4rT_%;]ߒᓑn ϙIx_})U B 3jta~ K]D|7(}%?ȨU=&1 ~x{`*Bf 7g6c2@R=n' h536|h2 s**0@dM6JXwwoُx͞=')'i |E 㯋fQQ ӻ&|bJb$q ӻ&
WG/첪30,=y4/s sW0WjaT=
LU~!37W W
2ZZ𥉉o ^G,<İʞ:[nXQת9 ㎯
3
_'?ܾ˨@qow:uϜ]f`HCZ}ȷ髈mj}]YчX4g3nimذwwGk;wFc4r 0k:\sc㦷6Tu1K7אY٨9
C N:͙Bo
M5 Y/ !Qhy207 q$f5n]H#-LDGz$1~߾_|kڽv}rPn 7e.\垚k),, <.`vKV `ĵ!IptK<.WOw >{yϏ{Ksl^;$!~>A$==XF:PO CEB ٳO>YsNC.-M-m~ =p//˽cǯ4 !$!5 ʱVC c 8 G#p8 G#p8 G#p8 G#p8 G#8#& IENDB` D @ C o m p a n y N a m e [ Y o u r C o m p a n y N a m e ] $$If 4!v h#v v#v:V l
t 0 ?*65 v5a4p yt* D @ A d d r e s s [ Y o u r C o m p a n y A d d r e s s H e r e ] $$If 4!v h#v v#v:V l
t 0 ?*65 v5a4p yt* D @ s e c u r i t e c o o r d i n a t o r [ S e c u r i t y C o o r d i n a t o r ' s N a m e ] $$If 4!v h#v v#v:V l
t 0 ?*65 v5a4p yt* D @ P I l o c a t i o n s - [ F i l i n g c a b i n e t s , s e r v e r s , a n d d e s k t o p P C s ] $$If 4!v h#v v#v:V l
t 0 ?*65 v5a4p yt* D @ A u d i t d a y s 3 0 $$If 4!v h#v v#v:V l O
t 0 ?*65 v5a4p yt* D @ P a t c h d a y s 3 0 $$If 4!v h#v v#v:V l O
t 0 ?*65 v5a4p yt* D @
F i r e w a l l b r a n d [ F i r e w a l l b r a n d h e r e ] $$If 4!v h#v v#v:V l
t 0 ?*65 v5a4p yt* D @ A n t i v i r u s b r a n d [ A n t i v i r u s b r a n d h e r e ] $$If 4!v h#v v#v:V l O
t 0 ?*65 v5a4p yt* s 2 0 @ P ` p 2 ( 0 @ P ` p 0 @ P ` p 0 @ P ` p 0 @ P ` p 0 @ P ` p 0 @ P ` p 8 X V ~ 0 @ 0 @ 0 @ 0 @ 0 @ 0 @ 0 @ 0 @ 0 @ 0 @ 0 @ 0 @ 0 @ 0 @ _HmH nH sH tH @ ` @ N o r m a l CJ _HaJ mH sH tH D A D D e f a u l t P a r a g r a p h F o n t R i@ R T a b l e N o r m a l 4
l 4 a ( k ( N o L i s t b o b 41 D e f a u l t 7$ 8$ H$ - B*CJ OJ QJ ^J _HaJ mH ph sH tH B ' B '#` C o m m e n t R e f e r e n c e CJ aJ < < '#` C o m m e n t T e x t CJ aJ @ j @ '#` C o m m e n t S u b j e c t 5\H 2H '#` B a l l o o n T e x t CJ OJ QJ ^J aJ j Cj 5s
T a b l e G r i d 7 :V 0 4 R4 6x H e a d e r
! 4 b4 6x F o o t e r
! PK ! [Content_Types].xmlN0EH-J@%ǎǢ|ș$زULTB l,3;r ØJB+$G]7O٭VvnB`2ǃ,!"E3p#9G Qd; H
xuv 0F[,F᚜K sO'3 w #vfSVbsؠyX p5veuw 1z@ l,i!b
I jZ2|9L$Z15xl.(zm${d:\@'23ln$^-@^i?D& |#td !6lġ B"&63yy@t!HjpU*yeXry3~{s:FXI
O5Y[Y!}S˪.7bd|n]671.
tn/w/+[t6}PsںsL. J;̊iN $AI)t2 Lmx:(}\-i* xQCJuWl'QyI@ھ
m2DB AR4 w¢naQ`ԲɁ
W=0#xBdT/.3-F>bYL%˓KK 6HhfPQ=h)GBms]_Ԡ'CZѨys
v@c])h 7Jهi c? FS .NP$
e&\Ӏ+I "'%QÕ@c![paAV.9Hd< ӮHVX*%A{Yr Aբ pxSL9":3U5U
NC(p% u@;[d`4)]t#9M4W=P5*f̰lk<_X-C wT%Ժ}B% Y,]
A̠&oʰŨ; \lc`|,bUv PK !
ѐ ' theme/theme/_rels/themeManager.xml.relsM
0wooӺ&݈Э5
6?$Q
,.aic21h:qm@RN;d`o7gK(M&$R(.1r'JЊT8V"AȻHu}|$b{ P8g/ ]QAsم(#L[ PK- ! [Content_Types].xmlPK- ! ֧ 6 0 _rels/.relsPK- ! ky theme/theme/themeManager.xmlPK- ! R% theme/theme/theme1.xmlPK- !
ѐ ' theme/theme/_rels/themeManager.xml.relsPK ]
[0 ~ & # < o $ K) , ]0 2 6 [8 $ ( * , . / 1 3 5 6 8 : =
1
q " Q } # ( - 0 2 6 S8 [8 ! " # % & ' ) + - 0 2 4 7 9 ; < > / d p y L X o " M k k
2
F
R u ' ; x ? S ~ r (
8 o (! K! _! ! ! ! i" " " K# ^# r# 9( \( p( ) * * * * * + + -+ - . 1. [0 FFFFFFFF l , b $ _3( PF H% 4~ @ (
V
3 A # " ` ? B
S ? [0 p t C o m p a n y N a m e A d d r e s s s e c u r i t e c o o r d i n a t o r P I l o c a t i o n s A u d i t d a y s P a t c h d a y s
F i r e w a l l b r a n d A n t i v i r u s b r a n d d y L \0 0 p \0 M0 M0 O0 P0 P0 R0 S0 U0 V0 X0 \0 \ b $ % %% 1% & & . / M0 \0 3 3 3 3 3 3 o 2 s ( L p s " l
k
G
R < x T ~ M r ) 9 o (! `! ! ! G" i" " K# s# )$ W$ $ $ 9( q( ( ) ) * * * * * + .+ , , - 2. . . L0 M0 M0 O0 P0 P0 R0 S0 U0 V0 X0 \0 " l
k
G
R < x T ~ r ) 9 o (! `! ! ! i" " K# s# 9( q( ) * * * + .+ - 2. L0 M0 M0 O0 P0 P0 R0 S0 U0 V0 X0 \0
TPk o/tj$ . v T f 81/ a$9lw qU|J ]Y y dXkH? ~ h p p^p`OJ QJ o( h H h @ @ ^@ `OJ QJ ^J o( h H o h ^`OJ QJ o( h H h ^`OJ QJ o( h H h ^`OJ QJ ^J o( h H o h ^`OJ QJ o( h H h P P^P`OJ QJ o( h H h ^ `OJ QJ ^J o( h H o h ^ `OJ QJ o( h H h p p^p`OJ QJ o( h H h @ @ ^@ `OJ QJ ^J o( h H o h ^`OJ QJ o( h H h ^`OJ QJ o( h H h ^`OJ QJ ^J o( h H o h ^`OJ QJ o( h H h P P^P`OJ QJ o( h H h ^ `OJ QJ ^J o( h H o h ^ `OJ QJ o( h H D\ D^D`\o( . h ^ `OJ QJ o( h H
L ^ `Lh H .
x x^x`h H .
H H^H`h H .
L ^`Lh H .
^`h H .
^`h H .
L ^ `Lh H . h @ @ ^@ `OJ QJ o( h H h ^`OJ QJ ^J o( h H o h ^`OJ QJ o( h H h ^`OJ QJ o( h H h ^`OJ QJ ^J o( h H o h P P^P`OJ QJ o( h H h ^ `OJ QJ o( h H h ^ `OJ QJ ^J o( h H o h ! !^!`OJ QJ o( h H h
^`h H . h
^`h H . h
pL p^p`Lh H . h
@ @ ^@ `h H . h
^`h H . h
L ^`Lh H . h
^`h H . h
^`h H . h
PL P^P`Lh H . h p p^p`OJ QJ o( h H h @ @ ^@ `OJ QJ ^J o( h H o h ^`OJ QJ o( h H h ^`OJ QJ o( h H h ^`OJ QJ ^J o( h H o h ^`OJ QJ o( h H h P P^P`OJ QJ o( h H h ^ `OJ QJ ^J o( h H o h ^ `OJ QJ o( h H h
^
`OJ QJ o( h H h ^ `OJ QJ ^J o( h H o h ^`OJ QJ o( h H h ^`OJ QJ o( h H h T T^T`OJ QJ ^J o( h H o h $ $^$`OJ QJ o( h H h ^`OJ QJ o( h H h ^ `OJ QJ ^J o( h H o h ^ `OJ QJ o( h H h p p^p`OJ QJ o( h H h @ @ ^@ `OJ QJ ^J o( h H o h ^`OJ QJ o( h H h ^`OJ QJ o( h H h ^`OJ QJ ^J o( h H o h ^`OJ QJ o( h H h P P^P`OJ QJ o( h H h ^ `OJ QJ ^J o( h H o h ^ `OJ QJ o( h H ^`OJ PJ QJ ^J o( ^`OJ QJ ^J o( h H o p p^p`OJ QJ o( h H @ @ ^@ `OJ QJ o( h H ^`OJ QJ ^J o( h H o ^`OJ QJ o( h H ^`OJ QJ o( h H ^`OJ QJ ^J o( h H o P P^P`OJ QJ o( h H 80 8^8`0o( .
^`h H .
pL p^p`Lh H .
@ @ ^@ `h H .
^`h H .
L ^`Lh H .
^`h H .
^`h H .
PL P^P`Lh H .
~ dXk a$9 ]Y o/ . T qU TP 81
kH' -N > bZz S R
ux w \m 5s "* '! t l Z w 5T P" U$ n& `U( 41 4 /c4 n5 %w7 R= 3N G=N O 2P 0 questions and the WISP will be automatically generated on the
2
= 0 following page
2
= 0 s
2
= 0 .
2
= 0 V 2
=2 0 Then simply review, print out, and sign the WISP.
2
= 0
2
S 0
Y0 @ Times New Roman - - - @ "Arial - - - - - - 2
iO 0 Y1.
- - -
2
i] 0 Y
- - - 4 2
ig 0 YWhat is your company name?
2
iZ 0 Y
Y0 ' ' ' Y @ Times New Roman - - - ( 2
g$ Y[Your Company Name]
2
g Y ' - @ ! X/ - - @ ! X/ - - @ ! X0 - - @ ! X - - @ ! X - - @ ! X - - @ ! X - - @ ! / Y/ - - @ ! / Y - - @ ! / Y - 0 - - - - - - 2
O 0 2.
- - -
2
] 0
- - - 8 2
g 0 What is your address (without
2
] 0 ZIP)?
2
0
0 ' ' ' - - - 4 2
$ [Your Company Address Here]
2
' - @ ! / - - @ ! 0 - - @ ! - - @ ! - - @ ! - - @ ! , / - - @ ! , - - @ ! , - 0 - - - - - - 2
O 0 3.
- - -
2
] 0
- - - J 2
g * 0 Who will be in charge of your Information
0 ' ' # 2
g 0 Security Policy?
2
0
2
0
0 ' '
2
O 0
@ Times New Roman - - - d 2
O ; 0 201 CMR 17 requires that you designate one person to be in
- - - ( 2
O 0 charge of security. - - -
2
0 - - -
2
0
' - - - 7 2
$ [Security Coordinator's Name]
2
' - @ ! / - - @ ! 0 - - @ ! - - @ ! - - @ ! - - @ ! e / - - @ ! e - - @ ! e - q 0 - - - - - - 2
,O 0 q4.
- - -
2
,] 0 q
- - - ) 2
,g 0 qPlease list location
/ 2
, 0 qs where you might store
q 0 ' ' 2
Ag 0 qPerson
" 2
A 0 qal Information.
2
A 0 q
q 0 ' ' - - -
2
UO 0 q - - - & 2
gO 0 qPlease use a comma
2
g 0 q- = 2
g ! 0 qseparated list like the example. - - -
2
g 0 q
' q - - - ; 2
*$ q[ Filing cabinets, servers, and 2
<$
qdesktop PCs ]
2
<} q ' - @ ! / - - @ ! 0 - - @ ! - - @ ! - - @ ! - - @ ! U / - - @ ! U - - @ ! U - r0 - - - - - - 2
O 0 r5.
- - -
2
] 0 r
- - - S 2
g 0 0 rHow frequently does your IT administrator audit
r0 ' ' C 2
g % 0 rserver logs for evidence of breaches?
2
0 r 2
0 r(in days)
2
0 r
r0 ' ' ' r - - - 2
$ rEvery 2
N r30
2
^ r 2
b rdays
2
~ r ' - @ ! q/ - - @ ! q0 - - @ ! q - - @ ! q - - @ ! q - - @ ! 8 r/ - - @ ! 8 r - - @ ! 8 r - 0 - - - - - - 2
O 0 6.
- - -
2
] 0
- - - V 2
g 2 0 How frequently does your IT administrator install
0 ' ' > 2
g " 0 operating system security patches?
2
0
0 ' ' ' - - - 2
$ Every 2
N 30
2
^ 2
b days.
2
' - @ ! / - - @ ! 0 - - @ ! - - @ ! - - @ ! - - @ ! 8 / - - @ ! 8 - - @ ! 8 - !0 - - - - - - 2
O 0 !7.
- - -
2
] 0 !
- - - @ 2
g # 0 !What type of firewall do you use?
2
| 0 !
!0 ' '
2
O 0 !
- - - - - - & 2
O 0 !Example: SonicWall
2
0 !, Juniper,
2
0 ! 2
0 !or Cisco. - - -
2
Q 0 !
' ! - - - + 2
$ ![Firewall brand here]
2
! ' - @ ! / - - @ ! 0 - - @ ! - - @ ! - - @ ! - - @ ! = / - - @ ! = - - @ ! = - \"0 - - - - - - 2
2O 0 "\8.
- - -
2
2] 0 "\
- - - @ 2
2g # 0 "\What Antivirus software do you use?
2
2 0 "\
\"0 ' ' - - -
2
EO 0 "\ @ 2
XO # 0 "\Example: Symantec Endpoint Security
2
XD 0 "\ ' \" - - - , 2
0$ "\[Antivirus brand here]
2
0 "\ ' - @ ! !/ - - @ ! !0 - - @ ! ! - - @ ! ! - - @ ! ! - - @ ! : "/ - - @ ! \/ - - @ ! \/ - - @ ! \0 - - @ ! : " - - @ ! \ - - @ ! \ - - @ ! : " - - @ ! \ - - @ ! \ - - - -
2
m 0
- - - g 2
= 0 Note: If you would like to further edit the WISP, go to View
2
Y 0 - 2
_ 0 > Toolbars
q 2
D 0 and check off the Forms toolbar. Then, click once on the lock icon
2
0 2
0 that
5 2
0 appears in the new toolbar.
R 2
c/ 0 If you are using an older version of Microsoft
m 2
A 0 Office, you may need to manually fill out the template with your
G 2
( 0 information instead of using this form.
2
; 0
@ Times New Roman -
-
@ Times New Roman - - - -2 A R , R , ( , R )() ?== 443 GFE YWV _\[ pnj ~y ÿ cb^ CB@ NML dbc uts ljf } ^\W BA@ wvn }x hga RRR qY [G K7 cS }m \H XA WA cI H0 K4 h cY { <* -%
K9 VVQ =) " U; k[ A) =' 4& qg lf} QQQ SE %# " " ^Yo ,, 7 4@ eB+ 444-/@,; e<
4-//// ,e e7 44-//. @@
e77HHf
4-/..@<<
<<@e tc e
*7TUOVPnrcc--.@@
B
@ 6 I ;/Uq|bjqqqbwQr.//.<<
, B
he * tc .
*nq}}l}}}{qqqqbwr .<,, htIhhI;ee 6 I B4 0*Tq}}}g}}}}}zjqqiqPVMvv.2vg{y{{{y{yyy{xPs5t 6 I tc 33 t t t tc Ic ;
7(( ((T{{z{zjU&"DUzdyyyyyyyyxX`BI t * t * t tc c I ItItIIttI t tttttttttt t t 5
((( (M{z{zjU#>"!HrqxiyxyxxdXsB t6 tc 6 I t
( t I t Ic
''(( U{z{yVC:::?>:?'Rjxxyxxxdk`, 3t * tc t tc c c* * c c c c t c ccc Ic I < '(' Uyz{jS?>:""Embxdddxd]r,,B c 6 IG 3 t c c7
I tIItItttI tc t 3 ec77* ''(UxPqPJ>9
Pp\dddk`<
I 3 Ic c t A
c A I t3 77777f0& ''(UyyiWC>>?"& 0'3"?!rddddd\Q<
I 3 6t =
tc c ; c % I 6 c c cccc 3 7c tc t7 777f & (NxyyN$""#LOqqwQ!"(wodod\Q@<@; c c3 *v3 v 3t 3 3 t I I c 3 c3 t A Ic t '3 (VdxxOC?Ypoooopl ">Euxodp\Q<@
3 ; 3 t t A( It$ t I t 3 t tc3 H++'3& 2(WddpkCJ\ok_K_^U8" Pooo\w@.t 3 c I tc c tccc I ccc tc ItI c cc t c c c t cI I t ccc ,'32& (Xpdo\J>"YopT?$#>?!rpooon<.. tc t Ic B=&3323FVpopiZNoq>>EMpoo\P// 3 t t tc e@***38333G\opooS>NoP0>EMpoooPs--
G%I t tI t Ic v****=6 38%3EG\oooo_?^oq=>>EMpoooP@4/@ ttt t t I ** 061%8%%EGdooooY>"_oqu??!n\k]p]s44/e I Ic t tc + *F01)) 9:#8DLoo\oo_J\pQ'"2Uk[[[is4/ c I tt t I t 066)11 :"98ELpooooZaoqr0&38 U[kNk]`- A))) )*A>#DYp\\oa$CNopgnQm!>'n[NN[]`4 1))))1)=("""?9Yo\\^$>>CY\oppg " ONN^[\g; 0)6)6*'::?DM\kkN#"":?CZYaS8>> ^^^^N\` e/A660)00='8#:8Uo[kkK9"D>>>">?2RN^^N\g I 1106 6 '888"#N\[[[aSSSKJ#>"?>:>":?">na^akQ45 fF 06 =='3%8:%N\NNN[[[[[^YK$?"?":>"?">2mUaakb47 7) ***=='33$83OkNNN^^^^^NNNYK:>:"""?"?>?=aaL[b-
f6 *=( &28 Pk^NNN^^^^^^^^^_$>>:CKS_SSKJ$!LaYY[l-7 5**+( &!J][^a^^aaaaaaaYaa_3CZ_YaYaYaYSZY_Y_Nb-+7. +++ ' !F][a^a^aaaaaaaaaaa__aYYYYYY_YYY____Nj/+- h++7)A( 2Fi^aaaYaaaYaYYYYaYYY_Y___Y______S_SNbc4 eHf7)1((&=]^YaYYYaYaYYYY_Y_Y____S______SSSSSNg 77
7*) ('GdNaYYY________YS_S_S___S_SSZSSSZZZ]`++ .
*61'=PPWP]ONN^^aLSLSSSSSSSSSSSSZZZSZZKabc*4 .
4--+*1 FFGSLYUNX[\P][[N^Y_SSZZKKKKZKKKKZP`**, /
--/..
6 ''2!E!%$& JGSTMUVWPPPXVUYYSZKJJLPQ+0* /4-//.@@
*11(' 33!D">D83J(KGLMMNOPNOOOQR*)0*14 //..@<<
<4 *1)( &3%8::>?9D88E%2!22 FGGGH0())6 *I .@@@
,B
.4 *1 (( 3338#"":#8%C33&& 222'2'( )1
<
@ --4 70)(( &3$%#9:""983$33&& '('((AA)* ;
<.( & 4- 7= ) (' 33%8:>?:%%%33&& ''(((65 56'& 074./- 76 ((' ' ( 3%%8#9::8%!&& ' * ,* -./+0) ((' &&& ' 11) ((' &2333!%$3)4 !""#$%&&'()*++++
' "System b<' h-' - - 0 0 / / . .
o
՜. +,0 h p
HOME W 50 3 Written Comprehensive Information Security Program Title
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q S T U V W X Y [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } R o o t E n t r y F 0$ D a t a
R 1 T a b l e Z G W o r d D o c u m e n t | S u m m a r y I n f o r m a t i o n ( ~ Ь D o c u m e n t S u m m a r y I n f o r m a t i o n 8 C o m p O b j r
F Microsoft Word 97-2003 Document
MSWordDoc Word.Document.8 9q