LESSON 31
Control Adjustment
This phase involves determining whether any controls can be designed, implemented, operated. The cost
of devising controls should not exceed the expected potential benefit being enchased and the potential
loss being avoided. The above decision takes into account consideration of various factors like personal
judgment of the situation, any information gained on desired/non-existing controls during the previous
phases, seeking demands of users for an ideal control environment.
Existing controls should not be totally discarded while adjusting controls. They can either be terminated
totally due to the threats not being there any more and existence of better controls either modified for
betterment. This phase should consider the security to be cost effective, and integrated.
31.1 Security to be cost effective
IT Guideline on security issued by IFAC states:
“Different levels and types of security may be required to address the risks to information. Security levels
and associated costs must be compatible with the value of the information.”
An organization should consider various factors to make security cost effective. These factors include
criticality of information assets, devising safeguards, cost of implementation of safe guards, an optimum
balance between the harm arising from a security breach and the costs associated with the safeguards.
Level of integration of security
There should be harmonization of security systems with information systems. This would help achieving
consistency in the security framework. Where information systems have some level of integration, the
security system should have a corresponding level of integration by accepting the level of
communication and interaction which is allowable in the IS itself.
31.2 Roles & Responsibility
For security to be effective, it is imperative that individual roles, responsibilities are clearly communicated
and understood by all. Organizations must assign security related functions in the appropriate manner to
nominated employees. Responsibilities to consider include:
1. Executive Management — assigned overall responsibility for the security of information;
2. Information Systems Security Professionals — responsible for the design,
implementation, management, and review of the organization’s security policy,
standards, measures, practices, and procedures;
3. Data Owners — responsible for determining sensitivity or classification levels of the data as
well as maintaining accuracy and integrity of the data resident on the information system;
4. Process Owners — responsible for ensuring that appropriate security, consistent with the
organization’s security policy, is embedded in their information systems;
5. Technology providers — responsible for assisting with the implementation of information
security;
6. Users — responsible for following the procedures set out in the organization’s security policy;
and
7. Information Systems Auditors — responsible for providing independent assurance to
management on the appropriateness of the security objectives.
docsity.com
