GOOD LUCK QUESTION 1 (20 marks) Your CIO requested you, as the newly appointed Information Security Manager, to prepare a memorandum to provide detail relating to the need for a Corporate Information Security Policy (CISP). Prepare a memorandum providing detail of what a CISP is, what role it should play in your organisation, what detail should be included in such a policy and how it relates to the information security management system (ISMS). Your memorandum should convince senior management that a CISP is indeed a critical component of an ISMS and core to the effective protection of your organisations valuable information assets. To support your motivation, briefly describe what an ISMS and its importance to an organisation The memorandum must be presented in a logical and readable manner, with clear section headings, on 2 to 3 pages [DO NOT EXCEED 3 PAGES!].

Risk management in general is a responsibility that belongs to the board. As information and IT are such critical assets to the well-being of your organisation, the CIO asked you, the newly appointed Information Security Manager, to prepare a detailed memorandum on what Risk Management entails in the domain of IT. This memorandum must address all the key aspects related to risk management, including: a brief explanation of what IT Risk Management is the various types and approaches to IT Risk Management the typical structure of a risk assessment exercise the various levels of management that should partake in risk management and related approaches relevant to each level any related information to explain the full context of IT Risk Management as it relates to the ISMS. The presentation must be structured in a logical and readable manner, with clear section headings, on 2 to 3 pages [DO NOT EXCEED 3 PAGES!].

As the newly appointed Information Security Manager, you are required to prepare a detailed SETA (Security Education, Training and Awareness] programme for your organisation. This programme must be founded on best practices and have the ultimate goal to cultivate an information security culture within your organisation. Provide detail of such a SETA programme highlighting, amongst others, the nature, content and recommended approaches of such a programme relevant to your organisation. The proposed SETA programme must be presented in a logical and readable manner, with clear section headings, on 2 to 3 pages [DO NOT EXCEED 3 PAGES!].