It’s vital for you to fully understand the information security management systems you have in place
But it’s a nuisance to keep track of them all. First, you need to know the status of every component, especially for the systems you outsourced. Then, you must also understand the different kinds of information the systems store, how it’s stored, how data is transmitted, and what kinds of information is transmitted.
It’s a chore to keep an accurate inventory of all the details. It’s a necessary chore, but it’s still a chore.
To start, you need to know your options in terms of what system you should use to track and store the necessary information. There are lots of applications and tools you could use, which makes it hard to stay on top of them all. But there is a useful, practical solution. You can read about it here. https://www.finosec.com/user-access-reporting
In the meantime, use these four high-level questions to get a better grasp on what you need to do to keep track of your information security systems.
Do any systems handle personally identifiable information (PII)?
Whenever your security systems handle identifiable customer information, you must have appropriate controls in place. It should be one of your top priorities to understand this aspect of your security systems. You should schedule regular reviews of how PII is handled within your information security systems.
Do any systems move money?
If one of your information security systems handles financial transactions or moves money, this is also a major factor. You need to be continually sensitive to the functions of every security system that oversees money movement.
Who are the system providers and where do they operate?
Do your vendors operate a cloud-based system/ Or do they operate out of physical locations and data warehouses? If the latter, where are the data centers located? You may have to gather a lot of information in order to fully answer this question. This is a perfect example of a time when a good inventory application for your information security systems would be really handy.
Who owns the system information and who administers it?
You can answer this question by making sure you know the current business owners and system admins for every one of your security systems. This knowledge helps you quickly determine who to contact whenever there’s a question or issue with a system.
“Business owners” maintain overall system health and handle contract renewals. “System administrators” oversee day-to-day system operations. Zach Duke, FINOSEC CEO and co-founder, shares helpful information about these different functions and their place in system operations in this video.
