Show description

Some levels may require double-locking (stored in a locked desk or cabined in a locked office), for instance. Destruction Classification guidelines need to include information on the proper disposal of classified information. Destruction procedures—steps to ensure that information is discarded in a way that renders it non-retrievable—need to include every type of media and likely context. For example, media destruction procedures should include proper disposal of hardcopy documents. In the workplace there are sure to be shredders or secure document disposal bins, but what about staff members who work primarily in home offices?

Goals While objectives describe desired end-states for an organization, goals specify specific accomplishments that will enable the organization to meet its objectives. Security Support of Mission, Objectives, and Goals Security professionals in an organization ought to be concerned with the reduction of risk through the proper activities and controls that protect assets and activities. We need to be keenly aware of our organizations’ mission, objectives, and goals, so that we can become involved in the key activities that the organization is undertaking.

For instance, a risk analysis on the use of laptop computers may identify theft as one risk. While the organization may mitigate the risk through the use of cable locks, it may transfer part of the risk to an insurance company. Note that risk transfer usually involves a cost (insurance premiums) that should be considered in a quantitative risk analysis. Residual Risk In any particular risk situation, generally only some of the risk can be avoided, reduced, or transferred. There is always some remaining risk, called residual risk.