1. Scope of the ISMS

[29] This ISMS is specific only to the three Certificate Authority [CA] rooms in Isa Town, the five Registration Authority Control Centre operator desks located on the ground floor of the National ID card issuing centre in Isa Town and the two Public Servers located in Juffair, in the Kingdom of Bahrain. The ISMS does not extend beyond these two geographicaal locations and the personnel that make up the operational and management team for these areas. It should also be noted that the Key Ceremony(s) that occurs is outside the physical environment and is not included in the ISMS, however, detailed scripts, explanations and security documentation from each Key Ceremony will be introduced into the ISMS as required.

The Information Security Management System covers all activities within the PKI [30] infrastructure in Juffair and ISA Town including related infrastructure key components such as Digi-CA and associated HSM. It relates to all assets, software and infrastructure used for storing, handling, processing and distributing digital certificates to Bahrain citizens.

1.2 Definitions

Where terms which are used in ISO27001:2005 are used here, the definitions provided in clause 3 of that standard are applied. Where terms are defined in ISO17799:2005 but not in ISO27001:2005, the ISO17799:2005 definitions are applied here.

1.3 ISMS

In particular, the ISMS is defined as the part (which includes organisational structure, policies, planning activities, plans, responsibilities, working practices, procedures, processes and resources) of the Organisation’s overall management system which, based on a business risk approach, enables management to establish, implement, operate, monitor, review, maintain and improve information security within the Organisation.

A current version of this document is available to PKI staff members of staff and is available on request from the Information Security Manager.

This procedure was approved by the Director General of IT and the Information Security Manager on 08 November, 2007 and is issued on a version controlled basis under his/her signature

Adlin Hisyamuddin Shaikh Salman Mohammed Al-Khalifa
Information Security Manager Director General of IT

____________________________ _______________________________

On:

08 November, 2007 08 November, 2007
____________________________ _______________________________

Change history

Issue 1 7 November, 2007 Initial issue

2. Documentation

2.1 Constituents

[29] The Organisation’s ISMS documentation consists of:

2.1.1 The scope statement (Section 1 above), information security policy (Section 5 below), and Statement of Applicability, all of which are included in this manual. This manual is, together with any separately published policies, the Organisation’s Tier 1 ISMS documentation. The control objectives described in this manual are achieved by controls that include policies (which provide board approved guidelines on specific control areas) and procedures. These policies are either included in, or referenced from, this manual; [ISO27001 4.3.1a, b, g and i]

2.1.2 The separate, version controlled risk assessment report and risk treatment plan, whose preparation follows the methodology described in Section 4 of this manual; [ISO27001 4.3.1c, d and f]

2.1.3 Records of how the Organisation applied (and continues to apply) the PLAN-DO-CHECK-ACT process, which is described in Section 3 of this manual, in the planning, implementation and maintenance of its ISMS; [ISO27001 4.3.3]

2.1.4 Those procedures, which describe how the policies are implemented, and which are identified in this manual but are separate from it, are Tier 2 documents; [ISO27001 4.3.1e]

2.1.5 Work Instructions and Operations Work Instructions, which set out specific requirements for the performance or execution of specific tasks, including for the measurement of the effectiveness of the controls, in the Organisation generally and in the [IT operations department] specifically, and which are identified in procedures, and similar documents, such as User Agreements and job descriptions, are Tier 3 documentation;

2.1.6 Records of the Organisation’s control of its information security processes, including details of audits, information security incidents and management reviews gathered during the CHECK phase, described in 3.3 below, are the fourth tier of the Organisation’s ISMS documentation. [ISO27001 4.3.1h]

2.2 Authorisation Levels

2.2.1 The organization has clearly defined authorization levels that cannot be delegated.

2.2.2 The board of directors has ultimate authority over the information security policy and ISMS and approves and authorizes all changes to the information security policy, the Statement of Applicability, the information security manual and any separate policy statements (tier 1 documents).

2.2.3 The Director General of IT (see sub section 6.1.3.2 [31]) has lead executive authority for information security and works with the Information Security Manager to approve, authorize and issue all tier 2 documents.

2.2.4 The Information Security Manager and the Director General of IT approve and authorize tier 3 documents owned by individuals or entities in their areas of responsibility. Any information security documents personally owned by any member of the Trust Centre Team have to be approved and authorized by the Director General of IT.

2.2.5 Owners of information assets (see sub section 7.1.2 [31] of the Manual) are responsible for the security classification of their asset(s), the day-to-day protection of their asset(s) and for the day-to-day operation of related security processes. The responsibility for carrying out these processes or associated task(s) can be delegated to anyone within the Owner’s area of responsibility, provided that:

a) The individual has the necessary skill, competence and resources to carry out the processes or task(s) and

b) The Owner retains accountability for ensuring that the process or task is carried out correctly.

2.2.6 Access rights are specified in sub section 11.1 below. Access rights are personal, are set out in individual User Agreements (see sub sections 11.2 [32] and 11.3 [32]) and cannot be delegated.

2.2.7 The authorization procedure for new information processing facilities is set out in DOC 6.4. wherever this type of reference occurs, can you specifically write [ISO27001 DOC 6.4] so the CIO knows where to find this.

2.3 The Organisation’s ISMS documentation is protected and controlled. There is a documented procedure (DOC ISMS 1) which takes 2.2 above into account and defines the management actions for document control. [ISO27001 4.3.2]

2.4 The Organisation has a documented procedure which defines the controls for identification, storage, protection, retrieval, retention time and disposal of records. [ISO27001 4.3.3] Documents are available to those who need and are authorised to access them in line with these retention requirements.

Adlin Hisyamuddin Shaikh Salman Mohammed Al-Khalifa
Information Security Manager Director General of IT

____________________________ _______________________________

On:

08 November, 2007 08 November, 2007
____________________________ _______________________________

Change history

Issue 1 08 November, 2007 Initial issue

3. PLAN-DO-CHECK-ACT

[29] 3.1 The PLAN Phase – Establish the ISMS

3.1 a) The Organisation defined the scope of the ISMS in Section 1.

3.1 b) The Organisation has defined its information security policy, which is set out in Section 5, to apply throughout the Organisation as defined in the scope (Section 1 above). The policy includes:

3.1 b1) A framework for setting objectives for the ISMS in order to preserve its competitive edge, cash-flow and commercial interests as applicable and an enabling mechanism for information sharing, for electronic operations and an overall sense of direction will continue to be aligned with Organizational goals and all personnel and principles involved with the CIO Trust Centre are committed to preserving the confidentiality, integrity and availability of all the physical and electronic information assets for action with regard to information security; [ISO27001 4.2.1 b1)].

3.1 b2) The requirement for “legal, regulatory and contractual” in accordance with the standard is adequately addressed by the Civil Service Bureau; [ISO27001 4.2.1 b2)]

3.1 b3) The strategic organizational and risk management context for the establishment and maintenance of the ISMS (“the Organization’s current strategic business plan and risk management framework provide the context for identifying, assessing, evaluating and controlling information-related risks”); [ISO27001 4.2.1b3)] and

3.1 b4) Reference to a systematic approach to risk assessment, the risk management framework (4.2 below) in which the criteria for risk evaluation are described and the structure of the risk assessment is defined (4.4 below). [ISO27001 4.2.1 b4)]

3.1 b5) The policy, and this manual, have been approved by The Director General of IT and the President of the CIO. [ISO27001 4.2.1 b5)]

3.1 c) The Organization has identified a suitable, systematic approach to and framework for risk assessment that produces comparable and reproducible results and that is appropriate for its business, legal, regulatory and contractual requirements, and this is described in Section 4 below. [ISO27001 4.2.1c)]

3.1 d) Identification of risks is carried out in line with the process set out in Section 4 below. [ISO27001 4.2.1d)]

3.1 e) Assessment (the analysis and evaluation) of risks is carried out in line with the process set out in Section 4 below. [ISO27001 4.2.1e)]

3.1 f) Options for risk treatment are identified and evaluated in line with the process set out in Section 4 below. [ISO27001 4.2.1f)]

3.1 g) Control objectives and controls are selected from [Annex A of ISO27001 :2005] to meet the criteria and requirements of the risk management framework, take into account the risk acceptance criteria (Section 4, below) and current legal, regulatory and contractual requirements and are contained in the Statement of Applicability [ISO27001 4.2.1g)], together with details of the controls currently implemented [ISO27001 4.2.1.j.2].

3.1 h) The Statement of Applicability is contained in Sections 5 - 15 of this manual and in approving this manual management accept the residual risks (see sub section 4.6.3 [32] also). [ISO27001 4.2.1h)]

3.1 i) Management authorises the implementation of the ISMS and any changes to this manual [and approve the residual risks] [ISO27001 4.2.1i)]

3.2 The DO Phase – Implement & Operate the ISMS

3.2 a) The Organisation’s risk treatment plan (DOC 4.1 [32]) reflects the decisions made in the PLAN phase, and identifies the management action, responsibilities and priorities for managing the identified information security risks. [ISO27001 4.2.2a)]

3.2 b) Appropriate funding and resources are, as described in the risk treatment plan, allocated to its implementation. [ISO27001 4.2.2b)]

3.2 c) The selected controls are implemented (and their implementation is co-ordinated across the Organisation) to meet the identified control objectives. [ISO27001 4.2.2c)]

3.2 d) The Organisation has defined how it measures the effectiveness of its controls and has specified how to use these measurements to improve control effectiveness to produce comparable and reproducible results, and this is set out in DOC 3.1. [ISO27001 4.2.2d]

3.2 e) Training and awareness programmes are implemented as required in the risk treatment plan. [ISO27001 4.2.2e)]

3.2 f) The operational management procedures and work instructions required in this policy are implemented. [ISO27001 4.2.2f)]

3.2 g) The Organisation has committed specific resources to the effective management of the ISMS, including the nomination of Mubarak Abdulla Alhiddi as the Chief Security Officer [CSO] for the Trust Centre and Adlin Hisyamuddin as the Information Security Manager; and the recruitment of additional technical staff, inclusion of information security in all jobs relating to the management, maintenance and operations of a National Trust Centre for the issuing of Digital Certificate [14] as well as investing in information security products and services as required by the risk treatment plan (DOC 4.1 [32]). [ISO27001 4.2.2g)]

3.2 h) The Organisation has implemented monitoring procedures and controls as required by control objectives 10.10 and 13.1 below. [ISO27001 4.2.2h)]

3.3 The CHECK Phase – Monitor and Review the ISMS

3.3 a) The controls implemented to meet control objectives 10.10 and 13.1 below are operated to [promptly detect processing errors, and] detect security events, to identify failed and successful security breaches and incidents, enable management to assess whether security activities are performed in line with the criteria set for them, and take action to resolve any breach of security in a way that reflects the Organisation’s priorities. Also see sub section 3.4 below. [ISO27001 4.2.3a)]

3.3 b) The Organisation and its management regularly review the effectiveness of the ISMS, in line with the policy and procedures identified in control 5.1.2 below, seek to continuously improve the effectiveness of the ISMS through analysing audit results, and monitoring events and activity, all in the context of the business goals and risk treatment plan, and at least once a year. [ISO27001 4.2.3b) and e), 7.1, 8.1]
3.3 c) The Organisation measures the effectiveness of controls, as set out in DOC 3.1, to verify that security requirements have been met. [ISO27001 4.2.3c)]

3.3 d) At planned intervals as well as whenever there are significant changes in the Organisation, technology, business objectives and processes, identified threats or external (legal, regulatory, social) changes, the Organisation reviews those aspects of its risk assessment and risk treatment plan, including levels of residual risk and acceptable risk (taking into account changes in the effectiveness of controls), that are affected by the changes, or carries out additional assessments of specific risks in relation to new technologies, and system or any other changes that affect Organisational information or information assets. [ISO27001 4.2.3d)]

3.3 e) Management ensures that the Organisation carries out regular internal ISMS and other audits, as required in controls 6.1.8, 15.2 and 15.3 below, and the results of these audits inform the reviews identified in 3.3b) above. [ISO27001 5.1.g & 4.2.3e)]

3.3 f) Actions or events that could impact the effectiveness of the ISMS are recorded in line with sub sections 10.10 and 13 below [ISO27001 4.2.3f & g)] and are reviewed at management review.

3.3 g) The risk treatment plan (DOC 4.1 [32]) is updated to take into account the findings of monitoring and reviewing activities.
3.3 The ACT Phase – Maintain & Improve the ISMS

3.4 Opportunities for The ISMS

3.4 a)Where improvement opportunities for the ISMS are identified during the CHECK phase (see 3.3b) and d) above), they are implemented if they meet the criteria of the risk treatment plan. [ISO27001 4.2.4a)]

3.4 b) The Organisation has documented procedures for corrective and preventative action throughout the ISMS (including but not limited to those in sections 10.2.2, 13, 14.1.5 and 15.2 of this manual; sub section 6.1.7 enables it to learn from the experiences of other organisations and control 13.2.2 ensures it learns from its own experiences) and these include evaluating the need for action to prevent the occurrence of non-conformities. [ISO27001 4.2.4b] All controls have an element of preventative action involved in them.

3.4 c) The results of reviews are communicated to everyone involved via email and action delegated to the appropriate people, in line with 6.1.3 and 13.2.1 below. [ISO27001 4.2.4c)]

3.4 d) The implemented improvements are subject to monitoring and audit (see 15 [32]) to ensure that their intended objectives have been achieved. [ISO27001 4.2.4 d)]

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

4. Risk Management Framework

4.1 Risk Approach

[29] The Organisation’s approach to risk, which has been specifically approved and authorised by management, is contained in the risk management framework, which it applies to its overall strategic planning process. The risk management framework is designed to identify and assess risks (including information security risk) in the business plan, to identify and evaluate options for the treatment of those risks, and to select control objectives and controls that will reduce those risks to acceptable levels within the context of the business plan, operational requirements, constraints and objectives and national and international legislation and regulation. [ISO17799 4.1 and 4.2]

4.2 Risk Framework

4.2.1 Choice of risk assessment tool/methodology

CIO has decided not to use an automated tool to perform risk assessments. Instead it has sought advice from external security consultants VigiTrust to set out the initial to procedures and documentation and in conjunction and co-operation with the Digi-CAST3™ Team, has been trained on the use of this manual and the implementation of the procedures necessary to produce a number of methodologies to perform risk assessment on a regular basis

4.2.2 Requirements

Risk assessments projects need to be carried out regularly and need to help CIO identify the threat landscape, vulnerabilities and threat levels associated to each vulnerability against each of its tangible and intangible assets.

4.2.3 Selection Criteria

CIO opted to work with Digi-Sign because of its knowledge of Certificate Authority [CA [4]] and Public Key Infrastructures [PKI [30]] and with VigiTrust because of their in the filed of risk assessment for particularly sensitive information and projects related to the security of sensitive assets.

4.2.4 Tools/Methodologies Considered

CIO considered tools such as RA2 or equivalent on the market. However these tools require a deep understanding of the current security threat landscape and are only extremely effective for security professionals.

It was therefore decided to work with security consultants who had their own methodologies backed by a proven track record of helping blue chip organizations to meet security best practice guidelines.

4.2.5 How the Tool/ Methodology was Selected
Some initial research was conducted by CIO as to whether an automated tool would be appropriate to perform the risk assessment tasks related to this project. It was very quickly identified that consultants would be required in order to engage with CIO and conduct risks assessments. After a full tendering process in accordance with the laws of the Kingdom of Bahrain and a lengthy and careful consideration process, Batelco and Digi-Sign were selected to provide this service to the CIO in co-operation with Digi-Sign’s ISO consultancy partner VigiTrust.

4.2.6 How the Methodology Works

The chosen methodology is based on benchmarking vulnerabilities and threats to each assets against a risk matrix. The matrix consists in evaluation of the asset in terms of importance to CIO, assigning a probability of likelihood for each threat and determining an absolute impact for the threat. The risk is calculated as follows:

Risk (aka “Absolute risk”) = Probability of Threat * Absolute Impact of Threat

The information below details all of the elements of this risk calculation model:

Evaluation of Assets

The operation owner defines the value of each asset detected depending on his perception of impact on operations) or on users in general in case of loss, theft, inaccessibility, deterioration / corruption or any other security violations. Perceived value is ranked as follows:

Unimportant (0) Damage on the asset never affects the data system

Not very important (1) Damage on the asset has very little impact on the data system. The data system keeps operating. Damage on it does not tarnish the company name.

Medium (2) Damage on the asset affects the data system. The data system keeps operating but the asset in question must be replaced. Damage thereon can affect the company name negatively to a somewhat noticeable extent.

Important (3) Damage on the asset has major impact on the data system. The data system is only half operational in that it may not be fully accessible or its integrity might have been somewhat compromised. The asset in question must be replaced. Damage thereon affects the company name adversely.

Very important (4) The asset plays a major part for the operation of the data system. Damage on the asset has a huge impact on the operability of the data system. Only parts of the data system remain useable. Damage thereon has substantial adverse impact on the company name.

Extremely important (5) The asset is essential for the operation of the data system. Damage on the asset directly influences the data system. The data system is out of operation. Damage thereof has very adverse impact on the company name.

At this stage Potential vulnerabilities are listed for each asset. Vulnerabilities are the weaknesses identified for assets. Potential threats are listed for each asset. Threats are potential tools by which vulnerabilities can be misused or exploited.

Important Note: The value as determined by the above procedure is entered in the “Critical” column Risk Treatment Plan file that accompanies this document and is referenced “Digi-CAST Asset List & Risk Treatment Issue 001-071107.xls”.
Threat Probability Values

Negligible (0) Not likely to happen.

Very low (1) Twice or three times in a period of 5 years.

Low (2) May happen once a year or a shorter period of time.

Medium (3) May happen every six months or within a period of time between one to 6 months.

High (4) May happen once a month or within a period of time between 2 days to one month.

Very high (5) May happen once a day.

Extremely High (6) May happen multiple times a day.

Threat Impact Values

Unimportant (0) The threat has no impact on the asset.

Small (1) The threat has little impact on the asset. There is no need to repair or re-configure the asset.

Important (2) Although the impact by the threat is minor and is only reported by a few persons or organizations, the threat can still have concrete damage. Corrective action involving time, effort and financial input may have to be implemented to make up for the damage and eradicate the issues.

Detrimental (3) The Threat can damage the reputation of asset and system operators. Significant spending may be necessary to repair the damage and eradicate the issues.

Serious (4) The Threat inflicts substantial damage on the asset and/or many staff members and the organization itself may be significantly impacted by the damage. Large scale restructuring may be necessary in the damaged system. Corrective action needs to be taken to eradicate the issues.

Very serious (5) Threats causes the asset to be out of operation indefinitely. It requires the system to be re-designed and re-structured totally. Corrective action needs to be taken to eradicate the issues.
The information pertaining to absolute risks requires the use of the values detailed above according to the formula, Absolute Risk = Threat Probability Value * Threat Impact Value.

So by determining the “Threat Probability Value” (i.e. 1 – 6) using the horizontal part of the following Risk Calculation Table and then searching down the vertical column for the “Threat Impact Value”, the “Absolute Risk Value” can be calculated.

Important Note: All three values are entered in the Risk Treatment Plan file that accompanies this document and is referenced “Digi-CAST Asset List & Risk Treatment Issue 001-071107.xls”.

Every time an asset is added or removed from the Trust Centre, this Digi-CAST™ [9] Manual and the “Digi-CAST Asset List & Risk Treatment” must be updated and must be signed by the Information Security Manual.

In addition, the new Issue must be circulated to all members of the Trust Centre Team and Trust Centre Management. And this is the responsibility of the Information Security Manager.


Risk Calculation Table




Probability of the Threat to Happen	Unimportant (0)	Minor (1)	Important (2)	Detrimental (3)	Serious (4)	Very serious (5)
Negligible (0)	None (0)	None (0)	None (0)	None (0)	None (0)	None (0)
Very low (1)	None (0)	Low (1)	Low (2)	Low (3)	Medium (4)	Medium (5)
Low (2)	None (0)	Low (2)	Medium (4)	Medium (6)	High (8)	High (10)
Medium (3)	None (0)	Low (3)	Medium (6)	High (9)	High (9)	Critical (15)
High (4)	None (0)	Medium (4)	High (8)	High (12)	Critical (16)	Very High (20)
Very High (5)	None (0)	Medium (5)	High (10)	Critical (15)	Very High (20)	Very High (25)
Extremely High (6)	None (0)	Medium (6)	High (12)	Critical (18)	Very High (24)	Very High (30)



Absolute Risk Table

 

Absolute Risk	Risk Score	Multiplication Values Corresponding to the Risk Score
None	0	0
Low	1	1,2,3
Medium	2	4,5,6
High	3	8,9,10,12
Critical	4	15,16,18
Very high	5	20,24,25,30

Actual Risk Value is calculated by using the following final formula:

1. Absolute Risk = Probability of the Threat * Absolute Impact of the Threat

2. Absolute Risk Score  Simplified Absolute Risk Score (Table 4)

3. Actual Risk Value = New Absolute Risk Score * Asset Value Identification of Targets, Controls and Counter Measures and Management of Risks
3–Step Absolute Risk Calculation

Step 1

Take into consideration the impact an event using the “Threat Impact Values” scale above (0 - 5).

Step 2

Then consider the likelihood it could happen using the “Threat Possibility Values” scale above (0 - 6).

Step 3

Then use the table, which gives you the risk for the RTP (it is a basic multiplier). The value you get will appear on the “Absolute Risk Table” and this enables you to label the Risk appropriately.

Example

Rack server:

The Rack could be physically damaged or it could collapse resulting in machines having to be powered off before being moved - results in disruption to services.

Probability of that happening is low (2) however impact of the issue, if it did happen, is high (4) as it would seriously disrupt services. Therefore the Absolute Risk Value is 4 x 2 = 8. The Absolute Risk (8) is then entered in the Absolute Risk column of the Digi-CAST Asset List & Risk Treatment.

In Summary

Low Absolute Risk Value is typically low to high impact with little probability of occurrence (or vice versa).

High Absolute Risk Value is typically high impact and high probability (unusual and rare, but may occur).

Medium Absolute Risk Value is more complicated and requires careful attention as it suggests that the impact would be medium to high and so is the probability. This is where indicating actual controls in place will ensure that a proper risk assessment has been conducted.

Consider the asset and carefully consider the likelihood of the potential threat happening. Should it happen, what impact would have it have on the CIO Trust Centre if it did happen and then using the above system assign figures and calculate the Absolute Risk Value.

4.2.7 Training requirements
The CIO Trust Centre staff must understand the scoring mechanism and regular training should be provided by the Information Security Manager to all the members of the Trust Centre Team. In addition ongoing security awareness through training, reference manual, demonstration and incident reporting, resolution and documentation is provided in order for Trust Centre Team to keep abreast of the latest threats in order to be able to continually assess risks and take pre-emptive action.

4.3 Information Security Risk Management

4.3.1 The Organisation has established and maintains its ISMS, and identifies and assesses information related risks, and evaluates options for their treatment, within the context of the risk management framework described in DOC 4.3 and performs risk assessments in line with DOC 4.4, using the tool selected following the procedure documented in DOC 4.2.

4.3.2 Control objectives and controls are selected from Annex A of [ISO27001/ISO17799:2005] on the basis of the conclusions to step 4.3.1. Additional control objectives and controls are, not required from other sources other than ISO27001. All control objectives and controls are documented in the Statement of Applicability, which is set out in Sections 5 to 15 of this manual.

4.3.3 A consolidated; corporate level risk treatment plan (DOC 4.1) is formulated in order to implement the selected controls.

4.3.4 The implementation is reviewed for effectiveness and, where possible, improvements are identified and these, within the context of the overall ISMS, are implemented, using a PDCA process.

4.3.5 This process is followed irrespective of whether a single risk is being considered, or multiple risks.

4.4 Risk Assessment Tool & Methodology
The Organisation’s method for risk assessment is to use risk assessment tool in this Digi-CAST™ [9] Manual and uses the procedure as set out below. This tool and methodology is suitable for the scope of the Organisation’s ISMS (Section 1), the business objectives (3.1b1 above), the security, contractual, legal and regulatory requirements (3.1b2) above and risk management framework that were identified earlier. The selection criteria are set out in DOC 4.2. [ISO27001 4.2.1c] and the risk assessment procedure itself is carried out as described in DOC 4.4.

4.4.1 Scope

This method of risk assessment is applied throughout the Organization in respect of information risks.

4.4.2 Responsibilities

The Information Security Manager is responsible for carrying out risk assessments wherever they are required by the ISMS.

Procedure

4.4.3 Identity of Risks

4.4.3.1 The assets that are within the scope of the ISMS are identified and listed in line with the requirements of DOC 7.1 [32] (asset inventory), The business, legal and contractual requirements and asset values are established at the same time and in line with DOC 7.1. [32]

4.4.3.2 When new information assets (in the broad sense of DOC 7.1 [32]) are acquired, or existing assets in any way changed, those assets are added to the inventory and are treated in line with the requirements below.

4.4.3.3 The threats to each of those assets are identified in process 4.1. For each asset within the ISMS, all applicable threats are selected from the list of example threats. The Information Security Manager is responsible for ensuring that the list of threats is adequate for the ISMS.

4.4.3.4 The vulnerabilities that might be exploited by each of these threats are identified once each threat has been identified and listed.

4.4.3.5 Where new vulnerabilities or weaknesses are identified (for e.g., through the information security event reporting procedure in DOC 13.1 [32]), the risk database is updated and, if appropriate, the risk assessment procedure set out here is repeated and any changed controls implemented.

4.4.3.6 Risk of exposure is assessed using process 4.2. For each threat/vulnerability combination, the threat likelihood and vulnerability level are calculated and a brief explanation may added for further clarity. Finally, at this stage, the security properties that are affected by this exposure risk are identified.

4.4.4 Assess the Risks

4.4.4.1The Information Security Manager will carry out the ISMS risk assessment on an ongoing basis. Once all the preceding steps have been completed and approved, the risks for each of the assets will be calculated within the ISMS.

4.4.4.2Within this process, a risk name is allocated to each threat/vulnerability combination and is placed within the appropriate risk category available.

4.4.5 Identify & Evaluate Options for the Treatment of Risks

4.4.5.1The appropriate risk treatment decision is made for each identified risk for each asset within the ISMS. The risk treatment decision is made in line with the requirements of DOC 4.3.

4.4.5.2For each of the risk treatment decisions, document the reasons for the decision in the appropriate tab, together with specific actions to be taken (usually, apply appropriate controls from Annex A of ISO 27001)

4.4.6 Select Control Objectives & Controls for Treatment of Risks

4.4.6.1Appropriate control objectives and controls are selected from Annex A of BS7799-2:2005/ISO17799.

4.4.6.2 These control objectives and controls are then manually summarized into the Statement of Applicability.

4.4.6.3. Provide justifications for all selected controls and for non-selected controls. Once this is complete for all controls.

4.4.6.4The complete Statement of Applicability is printed out, a signed copy retained by the Information Security Manager and decision for each control objective and control is manually transferred to the ISMS Manual, which describes how each control is actually implemented.

4.4.7 Implementation

Controls are implemented according to relevant associated processes and OWIs pertaining to each threat.

The Information Security Manager is the owner of this document and is responsible for ensuring that this procedure is reviewed in line with the review requirements of the ISMS.

A current version of this document is available to the Trust Centre team members on request.

This procedure was approved by the Director General of IT and the President of the CIO on 08 November 2007 and is issued on a version-controlled basis under their signatures.

4.5 Systematic approach to risk assessment
The Organisation has a documented approach (framework in DOC 4.3, tool in DOC 4.2 and procedure/methodology in DOC 4.4) to risk assessment.

4.6 Prepare a Statement of Applicability

4.6.1 The control objectives and controls selected in line with clause 4.5, and as a result of carrying out the procedure identified in DOC 4.4, are documented in a Statement of Applicability, which forms Sections 5 to 15 of this Manual.

4.6.2 Any controls or control objectives in Annex A of [ISO27001/ISO17799:2005] that are excluded are documented, together with the justification for their exclusion; any additional controls or control objectives that may be required are also documented in the Statement of Applicability.

4.6.3 The remaining residual risks are highlighted in the risk treatment plan (DOC 4.1) as required by DOC 4.3, and board authorisation is obtained for implementation of the ISMS.

4.6.4 Any changes to the risk treatment plan (DOC 4.1), which lead to a change in the ISMS, are subject to authorisation by the board.

Shaikh Salman Mohammed Al-Khalifa Mohammed Al-Amer
Director General of IT President of CIO

____________________________ _______________________________

On:

08 November, 2007 08 November, 2007
____________________________ _______________________________
Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

5. Information Security Policy

5 [29] Information Security Policy
Control objective: The organization provides management direction and support for information security in accordance with business requirements and relevant laws and regulations of the Kingdom of Bahrain.

5.1.1 Information security policy document

The management team and the board of directors have approved and authorized an information security policy for the Organisation. This policy is set out below and is authorized for separate distribution under the President of CIO’s signature, with the reference DOC 5.1. A current version of this document is available to all staff and contractors, and to external parties [when signing supply contracts]. The development of the information security policy is carried out under the PDCA process described in Section 3 of the Information Security Manual.

INFORMATION SECURITY POLICY

The Board and management of The Central Informatics Organization [CIO], located at National Smart Card Centre [NSCC], Building 1088, Road 4025, Block 842, Isa Town and Government Data Network Centre, 1091, Road 4225, Juffair 342, and both locations are in the Kingdom of Bahrain and provide for the operation of the National ID card, identity verification and validation of the citizens and residents of the Kingdom of Bahrain is in the business of providing Digital Certificates [14] and related Public Key Infrastructure [PKI [30]] services, are committed to preserving the confidentiality, integrity and availability of all the physical and electronic information assets throughout the CIO CA [4] and RA areas in order to preserve the integrity, reputation and security of the citizens, residents and Government Departments and Agents it serves. Information and information security requirements will continue to be aligned with the CIO goals and the ISMS is intended to be an enabling mechanism for information sharing, for electronic operations and for reducing information-related risks to acceptable levels.
The CIO’s current strategic business plan and risk management framework provide the context for identifying, assessing, evaluating and controlling information-related risks through the establishment and maintenance of an ISMS. The risk assessment, Statement of Applicability and risk treatment plan identify how information-related risks are controlled. The Information Security Manager is responsible for the management and maintenance of the risk treatment plan. Additional risk assessments may, where necessary, be carried out to determine appropriate controls for specific risks.
In particular, business continuity and contingency plans, data back up procedures, avoidance of viruses and hackers, access control to systems and information security incident reporting are fundamental to this policy. Control objectives for each of these areas are contained in the Manual and are supported by specific, documented policies and procedures.
All employees of the CIO [and certain external parties identified in the ISMS] are expected to comply with this policy and with the ISMS that implements this policy. All staff, and certain external parties, will receive appropriate training, initially by the Digi-CAST3™ Team and ultimately by the Information Security Manager.

The CIO has established Trust Centre top-level management steering committee chaired by the Director General of IT and including the President of the CIO and the Chief Security Officer to support the ISMS framework and to periodically review the security policy.

The CIO is committed to achieving certification [10] of its ISMS to ISO27001:2005

This policy will be reviewed to respond to any changes in the risk assessment or risk treatment plan and at least annually.
In this policy, “information security” is defined as:
preserving
This means that management, all full time or part time staff, sub contractors, project consultants and any external parties have, and will be made aware of, their responsibilities (which are defined in their job descriptions or contracts) to preserve information security, to report security breaches (in line with the policy and procedures identified in Section 13 of the Manual) and to act in accordance with the requirements of the ISMS. The consequences of security policy violations are described in the [organization’s] disciplinary policy. All staff will receive information security awareness training and more specialized staff will receive appropriately specialized information security training
the availability.
This means that information and associated assets should be accessible to authorized users when required and therefore physically secure. The computer network identified as part of the scoping work for Section 1 of the Manual is resilient and the organization is able to detect and respond rapidly to incidents (such as viruses and other malware) that threaten the continued availability of assets, systems and information. There are appropriate business continuity plans to meet the requirements of the CIO Trust Centre as approved by the Director General of IT.
Confidentiality
This involves ensuring that information is only accessible to those authorized to access it and therefore to preventing both deliberate and accidental unauthorized access to the CIO Trust Centre’s information and proprietary knowledge and its systems including its network(s), website(s), extranet(s), and e-commerce systems.

And integrity
This involves safeguarding the accuracy and completeness of information and processing methods and therefore requires preventing deliberate or accidental, partial or complete, destruction, or unauthorized modification, of either physical assets or electronic data. There must be appropriate contingency [including for network(s), e-commerce system(s), web site(s), extranet(s)] and data back-up plans, and security incident reporting. The CIO Trust Centre will comply with all relevant data-related legislation in the Kingdom of Bahrain within which it operates.
Of the physical (assets)

The physical assets of the CIO Trust Centre including but not limited to computer hardware, data cabling, telephone systems, filing systems and physical data files and information assets
The information assets include information printed or written on paper, transmitted by post or shown in films, or spoken in conversation, as well as information stored electronically on servers, web site(s), extranet(s), intranet(s), PCs, laptops, mobile phones and PDAs as well as on CD ROMs, floppy disks, USB sticks, back up tapes and any other digital or magnetic media, and information transmitted electronically by any means. In this context “data” also includes the sets of instructions that tell the system(s) how to manipulate information (i.e. the software: operating systems, applications, utilities, etc)
of the CIO.
The CIO Trust Centre and such partners that are part of our integrated network and have signed up to our security policy and have accepted our ISMS.

The ISMS is the Information Security Management System, of which this policy, the information security manual (“the Manual”) and other supporting and related documentation is a part, and which has been designed in accordance with the [specification contained in ISO27001:2005]

A SECURITY BREACH

A SECURITY BREACH is any incident or activity that causes or may cause a break down in the availability, confidentiality or integrity of the physical or electronic information assets of the Organization.

The Information Security Manager is the Owner of this document and is responsible for ensuring that this policy document is reviewed in line with the requirements in clause 5.1.2 in the Manual.

A current version of this document is available to all members of staff on the on request and as it does not contain confidential information, it can be released to relevant external parties.

This information security policy was approved by the Trust Centre Committee and the Directors of the CIO on 08 November, 2007 and is issued on a version-controlled basis under the signature of the Information Security Manager.

Shaikh Salman Mohammed Al-Khalifa Mohammed Al-Amer
Director General of IT President of CIO

____________________________ _______________________________
On:

08 November, 2007 08 November, 2007
____________________________ _______________________________

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

5.1.2 Review of the information security policy

The Organisation’s information security policy is reviewed at planned intervals, or when and if significant changes occur, to ensure its continuing suitability, adequacy, and effectiveness.

5.1.2.1The Information Security Manager is the Owner of the information security policy and has approved management responsibility for the development, review and evaluation of the policy.

5.1.2.2The Organisation has a defined procedure (DOC 5.2) for the management review of the information security policy, and this includes continuous improvement, and assessing policy changes that might be necessary in response to significant changes in the organisational environment, business circumstances, legal conditions or technical environment.

Note: The Information Security Manager accepts his role as owner of this document and intends to conduct several internal audits before 30 November, 2007 to ensure all aspects of the ISMS are correct, accurate and that this ISMS accurately reflects the total CIO Trust Centre environment.

5.1.2.3 All changes to the information security policy are subject to approval by the Organisation’s board.

Adlin Hisyamuddin
Information Security Manager
____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

6. Organisation of Information Security

6 Organisation of Information Security

6.1 Internal Organisation

[29] Control objective: management of information security within the Organisation and establishment of a management framework for the initiation, implementation and control of the ISMS.

6.1.1 Management commitment to information security

The Organisation’s management actively supports information security within the Organisation through clear direction, demonstrated commitment, explicit assignment and acknowledgement of its – and everyone else’s - information security responsibilities.

6.1.1.1 The board has, in approving this Manual and the information security policy, expressed its clear support for information security within the Organisation and ensured that the information security policy meets identified information security risks and supports the business goals.

6.1.1.2 The board has explicitly assigned lead responsibility for information security, in the management team, to the Director General of IT (also referred to in the organisational structure in Appendix III as the “Change Manager”)

6.1.1.3 The board has allocated clear responsibilities to management and specific individuals for specific aspects of information security and these responsibilities are documented throughout the ISMS.

6.1.1.4The board has ensured that there are adequately funded, resourced and trained to provide the level of information security it requires.

6.1.1.5The board has identified the need for specialist information security advice and has appointed Digi-Sign & Vigitrust to provide this expertise, reporting to the Director General of IT. The Director General of IT is responsible for reviewing the effectiveness and value of this advice and ensuring that it is co-ordinated across the Organisation.

6.1.1.6 The board has set up a dedicated management group to support the Director General of IT in managing information security within the Organisation, to be called the Information Security Committee. The goals of this committee, its members and its method of working are set out in procedure DOC 6.1.

6.1.2 Information security co-ordination

Due to the small size of the organisation, it co-ordinates its information security activities through a the Trust Centre Managers consisting of Director General of IT and the Information Security Manager from different parts of the organisation who have relevant roles and job functions

6.1.2.1 The goals of the managers and methods of working are set out in procedure DOC 6.2.

The Organisation has clearly defined all information security responsibilities.

6.1.3 Allocation of information security responsibilities

6.1.3.1 Responsibilities for specific information security procedures are clearly defined throughout the ISMS, and are documented in individual job descriptions in line with the requirements of 8.1.1 below.

6.1.3.2 The Director General of IT, who has lead responsibility in the management team for information security (see 6.1.1.2 ) for the development, implementation and maintenance of the ISMS.

6.1.3.3 The Information Security Manager reports to the Director General of IT.

6.1.3.4 The Information Security Manager’s responsibilities are documented in his job description and includes the day-to-day responsibility for the implementation and maintenance of the ISMS.

The Organisation has clearly defined all information security responsibilities

6.1.3.5 All staff (and certain third party contractors) have accepted their specific responsibilities in the User Agreements which they sign before they are authorized to access organisational information assets.

6.1.3.6 All information assets have been identified (see 7.1.1 [32]) and the security processes associated with each asset have been defined following a risk assessment (see sub section 4.4 [32]) and documented on the asset inventory schedules (see sub section 7.1 [32]).

6.1.3.7 All assets have identified Owners (see 7.1.2 [32]), whose responsibility for the day-to-day maintenance of the controls applied to their asset is documented in their job descriptions (see 8.1.1 [32]) and elsewhere through the ISMS.

6.1.3.8 The two sites have an identified Site Manager, the Information Security Manager, who is responsible for co-ordinating information security activities or carrying out specific processes within the two sites in line with the Manual and applicable procedures. The authority of this individual is in their job descriptions (see 8.1.1 [32]).

6.1.3.9 Authorisation levels are clearly defined and documented (see manual sub section 2.2) and enforce segregation of duties (see 10.1.3 [32]).

6.1.4 Authorisation process for information processing facilities

The Organisation has defined and implemented a management authorisation process (see DOC 6.4) for new information processing facilities.

6.1.5 Confidentiality agreements

A confidentiality and non-disclosure agreement (DOC 6.5) reflecting the Organisation’s requirements for the handling of information is in place (also see 8.1.3 [32]) and is reviewed regularly

6.1.6 Contact with authorities

The Organisation maintains appropriate contacts with relevant authorities

6.1.6.1The Information Security Manager is responsible for identifying (DOC 6.6) those authorities with whom the Organization needs to maintain contacts, to support information security incident management (sub section 13.2, below), business continuity management (Section 14, below), and continuous improvement.

6.1.7 Contact with special interest groups

The organisation maintains appropriate contact with special interest groups and other specialist security forums and professional associations

6.1.7.1 The Information Security Manager is responsible, on behalf of the Organisation, for identifying and joining those forums and special interest groups which he considers will enable him to effectively meet the responsibilities contained in his job description.

6.1.7.2 The Information Security Manager is required to ensure the Organisation has up-to-date information security knowledge, including about the changing malware threat environment.

6.1.7.3 The Organisation’s Information Security Incident Management procedure (see Section 13 [32]) requires the Information Security Manager to have suitable liaison for dealing with incidents

6.1.8 Independent review of information security
The Organisation’s approach to managing information security and its implementation (i.e. control objectives, controls, policies, rules, processes and procedures for information security) is independently reviewed at planned intervals, and when significant changes to the security implementation occur.

6.1.8.1 The Director General of IT is responsible for organizing independent audits of the ISMS. Where necessary, the Director General of IT in conjunction with the Information Security Manager engages expert (technical) external assistance. The audit procedures are contained in DOC 6.7 and sub section 15.3 of this Manual is also applicable.

6.1.8.2 The ISMS is also subject to periodic reviews by external compliance [33] auditors.

6.1.8.3 Risk assessments are [independently] reviewed annually to ensure that they are still complete and up-to-date.

6.2 External Parties

Control objective: to maintain the security of organisational information processing facilities and information assets that are accessed, processed, communicated to or managed by external parties

6.2.1 Identification of risks related to external parties

The Organisation’s procedures for identifying risks to its information assets and information processing facilities from business processes involving external parties, and for implementing appropriate controls before granting access, are identified in DOC 6.8.

6.2.2 Addressing security when dealing with customers

All identified security requirements are addressed, in line with the procedure in DOC 6.8 and the Organisation does not apply this control because none of its customers access any of its information assets.

6.2.3 Addressing security in third party agreements

Agreements with third parties involving accessing, processing, communicating or managing organisational information assets or information processing facilities, or adding products or services to information processing facilities, contain or refer to all identified security requirements, as required in DOC 6.8, and third parties are not allowed to access the Organisation’s information assets until such an agreement has been signed.

6.2.3.1 Where an external provider has a standard agreement and no provision to vary it to meet a client’s requirement, the external parties standard clauses are assessed against the Organisation’s requirements and the risk associated with the gap is assessed before deciding whether or not to proceed with the offered terms. Where there is a significant variation between the requirements and what is offered, the Director General of IT’s approval to proceed with the provider is required.

6.3 Authorizing New Information Processing Facilities

6.3.1 Scope
The Organization requires that the procurement of all information processing facilities be subject to a formal authorization process in respect of information security.

“Facility” is defined as “any system(s) or device(s) that will be used to process or store organizational information or that will connect to an organizational network or other information processing facility.” It includes hardware, software and services.

6.3.2 Responsibilities

6.3.2.1 The Information Security Manager is responsible for business approvals.
6.3.2.2 The Site managers have responsibility for site approvals
6.3.2.3 The Information Security Manager has responsibility for technical approval
6.3.2.4 The Information Security Manager has responsibility for security approval
6.3.2.5 The Director General of IT is responsible for procurement

6.3.3 Procedure

a) Approved (as to adequacy for the business purpose) and authorized by the line manager who/whose team will use them (business approval);
b) Approved and authorized by the local Site Managers (see 6.1.3.8) as to meeting all relevant security policies and requirements are met (site approval);
c) Approved and authorized by the IT Manager as to compatibility with current (and planned future) system components (technical approval);
d) Approved and authorized by the Information Security Manager as to meeting information security requirements (e.g. information classification, anti-malware, etc) (security approval).
e) Signatures and dates must be on the procurement documentation before the procurement can proceed.

6.3.4 Information Processing Devices

User-level information processing devices (notebooks, PDAs, mobile phones, etc) are all considered as “facilities” in terms of this procedure and the Organization requires each individual deployment of any such device to be approved and authorized in line with this procedure. Where relevant, a risk assessment will be carried out in line with DOC 4.4 [32]

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

7. Asset Management

Control objective: to achieve and maintain appropriate protection of organizational assets.

[29] 7.1.Responsibility for Asset

7.1.1 Inventory of assets

All information assets are clearly identified, and an inventory of all important assets has been drawn up and is maintained in line with the requirements of DOC 7.1

7.1.2 Ownership of assets

All assets associated with the information systems or services are ‘owned’ by a designated individual or part of the Organisation, and details of the Owner are identified on the asset inventory in line with DOC 7.1.

7.1.3 Acceptable use of assets

Rules for the acceptable use of information and assets associated with information processing facilities have been identified, documented and implemented.

7.1.3.1 The Civil Service Bureau, that ultimately reported to the Director General of IT, is responsible for ensuring that all users sign User Agreements (see sub section 11.2 [32]), which set out requirements for acceptable use of information assets and in which they also explicitly accept the Organisation’s Internet Acceptable Use Policy (DOC 7.2).

7.1.3.2These User Agreements (see sub section 11.2 [32]) also explicitly accept the Organisation’s Rules for Use of E-mail (DOC 7.3).

7.1.3.3The Information Security Manager is responsible for monitoring compliance, as set out in Work Instruction DOC 7.4, with the AUP as set out in 5.1.1 of this manual

7.1.3.4Guidelines for the use of mobile devices are included in the ‘mobile on the road’ annex to the User Agreement (see sub sections 11.2 [32] 11.7 [32]) for users issued with such devices.

7.2 Information Classification

Control objective: to ensure that information receives an appropriate level of protection

7.2.1 Classification guidelines

Information has been classified in terms of value, legal requirements, sensitivity and criticality to the Organisation

7.2.1.1 The Organisation has developed guidelines for information classification, which are suited to business needs (including legality, value, sensitivity and criticality) to both restrict and share information, and to the business impacts associated with those needs, and these are contained in DOC 7.6

7.2.2 Information labelling and handling
An appropriate set of procedures for information labelling and handling has been developed in accordance with the classification scheme adopted by the Organisation and this is set out in DOC 7.6

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

8. Human Resource Security

Control objective: to ensure that all employees, contractors and third party users understand their responsibilities, and are suitable for the roles they are considered for, and to reduce the risk of theft, fraud or misuse of facilities.

[29] 8.1 Prior to Employment

8.1.1 Roles and responsibilities

Security roles and responsibilities of employees, contractors and third party users have been defined and documented as required by the Organisation’s information security policy.

8.1.1.1 The Civil Service Bureau is responsible for ensuring that the Organisation has standard job descriptions for all roles, that contain defined security roles and responsibilities, and that these apply to all users of Organisational information assets. Job descriptions are provided to all prospective users prior to their recruitment.

8.1.1.2 The Information Security Manager is responsible for ensuring that information security and IT staff have specific information security responsibilities and that these are detailed in their job descriptions.

8.1.1.3 The Civil Service Bureau is responsible for ensuring that all users sign User Agreements (see 11.2 [32]) before they are allowed to access Organisational information assets; these User Agreements contain specific information security responsibilities.

8.1.1.4 Owners of information assets have specific responsibilities, and these are documented in sub section 7.1.2 above.

8.1.1.5Other responsibilities are identified as necessary throughout the ISMS.

8.1.2 Screening

Background verification checks on all candidates for employment, contractors and third party users are carried out in line with DOC 8.1 and in accordance with the laws, regulations and ethics of the Kingdom of Bahrain, and proportional to the Organization business requirements, the classification of the information to be accessed, and the perceived risks

8.1.3 Terms and conditions of employment
Employees, contractors and third party users must agree and sign the terms and conditions of their employment contract, which state their and the Organization responsibility for information security

8.2 During Employment
Control objective: to ensure that all employees, contractors and third party users are aware of information security threats and concerns, their responsibilities and liabilities, and are equipped to support organizational security policy in the course of their normal work, and to reduce the risk of human error.

8.2.1 Management responsibilities
Management requires employees, contractors and third party users to apply security in accordance with the policies and procedures of the Organization ISMS
8.2.1.1 Management ensures that employees, contractors and third parties are appropriately briefed prior to being granted access to Organizational information assets (see 8.2.2).

8.2.1.2 Management ensures that employees, contractors and third parties receive guidelines on security expectations (User Agreement, job descriptions and terms and conditions of employment).

8.2.1.3 Management provides personal leadership and example in information security and ensures that the Organization policies and procedures are followed (see 6.1.8 [32]).


8.2.2. Information security awareness, education and training

All employees of the Organization and, where relevant, contractors and third party users receive appropriate awareness training and regular updates in organizational policies and procedures, as relevant for their job function.

8.2.2.1 The Information Security Manager is responsible for ensuring that all users receive standard information security induction and awareness training before they are allowed to access Organizational information assets. This includes the incident reporting procedure.

8.2.2.2 The Information Security Manager is responsible fore ensuring that all users receive regular updates and alerts on information security issues as and when necessary, and that additional security-related training is made available as and when required.

8.2.2.3 The Information Security Manager is responsible for ensuring that specialized information security staff receive appropriate specialist training in line with their job requirements.

8.2.3 Disciplinary process

The Organisation has a formal disciplinary process for employees who have committed a security breach

8.2.3.1 Breaches of the Organisation’s ISMS may be treated as misconduct in terms of the Organisation’s disciplinary policy as issued by the Civil Service Bureau (which is set out in [where?]) and serious breaches may lead to dismissal.

8.3 Termination or Change of Employment
Control objective: to ensure that employees, contractors and third party users exit an organisation or change employment in an orderly manner

8.3.1 Termination responsibilities
Responsibilities for performing employment termination have been clearly defined and assigned by the Civil Service Bureau.

8.3.2 Return of assets
All employees, contractors and third party users are required to return all Organisational assets in their possession upon termination of their employment, contract or agreement.

8.3.3 Removal of access rights
The access rights of all employees, contractors and third party users to information and information processing facilities are removed upon termination of their employment, contract or agreement, or adjusted upon change

Shaikh Salman Mohammed Al-Khalifa Mohammed Al-Amer
Director General of IT President of CIO

____________________________ _______________________________

On:

08 November, 2007 08 November, 2007
____________________________ _______________________________

9. Physical & Environment Security

Control objective: to prevent unauthorized physical access, damage and interference to the organization premises and information.

[29] 9.1 Secure Areas

9.1.1 Physical security perimeter

The Organization uses security perimeters to protect areas that contain information and information processing facilities.

9.1.1.1 All the Organization sites have physical security perimeters. The minimum specification checklist for the physical security perimeter is in DOC 9.7 and the Information Security Manager ensures that each site is checked on a monthly basis.

9.1.1.2 The Information Security Manager is responsible for maintaining both site’s secure perimeter.

9.1.1.3 The Organization central information processing facilities are within secure areas, each of which have Owners (see sub section 7.1.2 [32]) that are themselves within a site’s secure perimeter.

9.1.1.4 The Information Security Manager has a site map for each site or secure area, together with a current security checklist DOC in sub section 9.7 that identifies the current state of conformity to the requirements in that checklist.

9.1.2 Physical entry controls
Secure areas are protected by appropriate entry controls to ensure that only authorized personnel are allowed access.

9.1.2.1 A risk assessment (see sub section 4.4 [32]) is used to determine the type of entry controls that might be required for secure areas and these are implemented in line with the requirements of DOC 9.6 and DOC 9.8.

9.1.2.2The Information Security Manager is responsible for maintaining required physical entry controls.

9.1.3 Securing offices, rooms and facilities

The Organization has designed and applied physical security for offices, rooms and facilities.

9.1.3.1The Organization conducts risk assessments (DOC 4.4 [32]) of individual offices, rooms and facilities that contain confidential or high risk information assets to identify the controls that might be necessary to secure them. These are implemented in line with DOC 9.7. There are no sites where confidential information processing facilities are shared with a third party organization, other than under the terms of a contract (see sub section 6.2.3 [32])


9.1.4 Protecting against external and environmental threats

The Organization has designed and applied physical protection against damage from fire, flood, earthquake, explosion, civil unrest, and other forms of natural or man-made disaster

9.1.4.1The Organization has assessed the risk of external and environmental threats and has applied controls that are included in DOC 9.7 or that are part of the Business Continuity Management framework (see Section 14 [32]).

9.1.5 Working in secure areas

The Organization has designed and applied physical protection and guidelines for working in secure areas and these are contained in DOC 9.8.

9.1.6 Public access, delivery and loading areas

Access points such as delivery and loading areas and other points where unauthorized persons may enter the premises are controlled and isolated from information processing facilities to avoid unauthorized access.

9.1.6.1The Organization controls for delivery and loading areas are detailed in DOC 9.9.

9.2 Equipment security

Control objective: to prevent loss, damage, theft or compromise of assets and interruption to the organization activities

9.2.1 Equipment site locating and protection

Equipment is sited and protected to reduce the risks from environmental threats and hazards, and opportunities for unauthorized access

9.2.1.1 The Information Security Manager is responsible for implementing the requirements of DOC 9.10, which include this control.

9.2.2 Supporting utilities
Equipment is protected from power failures and other disruptions caused by failures in supporting utilities.

9.2.2.1The Information Security Manager is responsible for implementing the requirements of DOC 9.10, which include this control.

9.2.3 Cabling security
Power and telecommunications cabling carrying data or supporting information services is protected from interception or damage

9.2.3.1The Information Security Manager is responsible for implementing the requirements of DOC 9.10, which include this control.

9.2.4 Equipment maintenance
Equipment is correctly maintained to ensure its continued availability and integrity

9.2.4.1The Information Security Manager is responsible for implementing the requirements of DOC 9.10, which include this control.

9.2.5 Security of equipment off-premises

Security is applied to off-site equipment taking into account the different risks of working outside the Organization premises

9.2.5.1Users of mobile equipment are required, as part of their User Agreements (see 11.1 [32]), to provide appropriate physical security for equipment when off-site and to ensure that manufacturer’s instructions for protecting equipment are followed.

9.2.5.2 Home working is not permitted for the Trust Centre.

9.2.5.3 The Organization specifically does not provides cover against loss of or damage to mobile devices because no mobile divides are used by the Trust Centre.


9.2.6 Secure disposal or re-use of equipment
All items of equipment containing storage media are checked to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal

9.2.6.1The Organization has a standard procedure (DOC 9.11) to ensure that storage media are made safe for disposal.

9.2.7 Removal of property
Equipment, information or software may not be taken off-site without prior authorization as required by DOC 9.12

9.7 Additional requirements

9.7.1 All organizational sites that contain information processing facilities are required to conform to the following minimum specification. Additional requirements may, dependent on a risk assessment, be applied to any site. In such cases, details of the risk assessment will be attached to the copy of this list.

9.7.2 If there is a computer or communications room or other designated secure area within one of the Organization’s sites, treat it as a separate set of premises and complete a checklist for each room AS WELL AS for the site.

9.7.3Ensure any Health and Safety issues have been identified and resolved.

PREMISES INSPECTION
Site Address:

Date and time of Inspection:
Inspector:

9.7.3 Attach a current site (room) map, with the physical security perimeter clearly marked.

9.7.4 Identify and list the information assets that are on the site together with their information security classification:

9.7.5 Checklist (identify improvement requirements):

a) Completeness of perimeter:
b) External walls of solid construction:
c) Access possible over walls/through roof?
d) Access possible under walls?
e) External doors solid?
1. With required locks/breach alarms?
2. With automatic closing mechanisms?
3. Remote access doors protected by cameras?
f) External windows locked/barred?
g) Fire doors alarmed and monitored in accordance with Work Instruction DOC 9.2
h) Fire alarms installed and working (DOC 9.2)
i) Fire suppression equipment installed and working (DOC 9.4)
j) Burglar/intruder alarms installed and working (DOC 9.3)
1. All [accessible] external windows covered?
2. All external doors covered?
3. Unoccupied areas alarmed at all times?
4. Reception area controlled (DOC 9.6)
k) Air conditioning installed and working (DOC 9.5)
l) Health and safety regulations [insert details of relevant code] applied?
m) (If it houses systems processing confidential information) how easy is it for the public to access the facility?
n) (If it houses systems processing confidential information) how unobtrusive is this to the public? Are there any obvious signs of information processing activities?
o) Are internal directories appropriately classified to restrict access to details of confidential sites?
p) Are hazardous, combustible materials safely stored (at a safe distance from a secure area)?
q) Are bulk supplies of non-confidential items stored outside secure areas?
r) Are necessary fire extinguishers available [insert details of requirements] and tested [insert details of testing regime]?

Distribution: copies of this report are held by the Premises Security Manager and the Information Security Manager.

The Site Security Managers at the CIO are the owners of this document and is responsible for ensuring that this procedure is reviewed in line with the review requirements of the ISMS.

9.8 Physical Entry Controls & Secure Areas

1 Scope [ISO 17799 clauses 9.1.2 and 9.1.3]

All designated secure areas (see DOC 9.7 and DOC 9.10) on any of the Organization’s premises are subject to controlled access and usage.

2 Responsibilities

2.1 Every secure area has an Owner (see sub section 7.1.2 [32] of the Manual) and the Owner is responsible for ensuring that prescribed controls are maintained and as otherwise specified below.

2.2 The [Site Manager/secure area Owner] is responsible for authorizing access to secure areas.

2.3 All employees, contractors and third parties have certain responsibilities as defined below. Procedure

3 Secure areas must be locked at all times. The lock specification is as set out in sub section 11.1 [32] of this manual. The Owner must check the secure area at least once per day, even if no-one is working in it.

4 Access to secure areas/areas where confidential or restricted information is processed (including in conversation) or stored is restricted to authorized persons. Authorization is provided as set out in sub section 11.1 [32] of this manual.

5 Access to secure areas requires authentication and authorized persons are issued with username and password access controls as provided and set out in sub section 11.1 [32] of this manual.

6 The Owner of a secure area is responsible for ensuring that no unsupervised working takes place within the secure area.

7 The authentication system retains a record of accesses and these are reviewed monthly to identify any unauthorized accesses.

9 The Owner of a secure area is responsible for ensuring that photographic, video, audio or other recording equipment and mobile phone cameras are not taken into the secure area.

10 All employees, contractors and third parties are required to wear an identification badge issued by the Guards at the entry point to the National Smart Card Centre on arrival. These ID cards are only issued upon presentation and verification of a Passport or CPR card and are required to notify security if they encounter unescorted visitors and anyone not wearing required identification (see DOC 9.6).

11 Third party support personnel only have access to secure areas when required and this access is specifically requested, authorized and monitored as set out in sub section 11.1 [32] of this manual.

12 In general, the Owner of a secure area and all those who are authorized to work within it, are required only to divulge details of the area and what is done in the area to other staff on a need to know basis.

9.10 Equipment Security

All information processing equipment owned or used by the Organization is subject to secure site location and protection requirements.

9.10.2 Responsibilities
9.10.2.1The Owner of an information asset as described in this ISMS is responsible for the site location and protection of information equipment.

9.10.2.2 The Site Managers are responsible for ensuring that equipment is protected from possible power supplies and other power-related disruptions.

9.10.2.3 The Site Managers are responsible for cabling security.

9.10.2.4 The Site Managers are is responsible for maintenance of equipment.

9.10.2.5 The Site Managers are responsible for the secure site location or all telecommunications facilities.

9.10.2.6 The Information Security Manager is responsible for defining and resourcing business continuity needs.

9.10.2.7The Director General of IT is responsible for insurance.

9.10.2.8 Where necessary, other responsibilities are identified in the course of this procedure.

9.10.2.10 Access to secure areas is controlled in line with DOC 9.8.

9.10.3 Site location and protection of equipment [ISO 17799 clause 9.2.1]

The requirements are:

a) That equipment is sited so as to minimize [public/unnecessary] access to work areas;
b) Information processing and storage equipment (including faxes, photocopiers and telephone equipment used for confidential information) is sited in secure areas [server/communications rooms/secured offices] so that it is not possible for confidential information to be seen by unauthorized people;
c) Secure areas are subject to the same level of physical perimeter protection as secure sites;
d) Equipment that requires special protection is isolated in the CA [4] Inner Core Room;
e) Controls are implemented to deal with theft (see sub section 9.1 of the Manual), natural or man-made disaster (see sub section 9.1.4 of the Manual).
f) The Organization does not allow smoking inside any of its sites, nor does it allow eating or drinking inside secure areas;
g) Secure areas are monitored for temperature increases above X degrees Celsius and an acceptable limit has been set at X degrees Celsius and the Information Security Manager receives an immediate alert as set out in the OWI for the fire detection system once they are breached.

9.10.4 Supporting utilities [ISO 17799 clause 9.2.2]

9.10.4.1 All servers and communications equipment used for the CA project are in secure areas that have adequate power supplies. For each secure area, the maximum power requirements are calculated by reference to the manufacturer’s recommendations for each device plus the requirements for other items running off the same supply plus an element for buffer to be allow for ongoing changes and the Site Managers have incoming power cables checked by cleared suppliers to ensure that they supply adequate power. Offices and other (non-secure) areas that contain information-processing equipment are similarly assessed to ensure that power supplies are adequate.

b) The Site Managers are responsible for ensuring that Heating and Ventilation engineers provide a formal report on the heating, cooling/air conditioning and ventilation requirements of each secure area and each site that contains information processing equipment and for reporting on the adequacy or otherwise of current installations. Shortfalls in requirements are to be treated by escalating their concerns to the Information Security Manager for Risk Assessment, treatment and the creation of an Operation Work Instruction [OWI] as necessary.

c) The Site Managers are responsible for ensuring that all supporting utilities and equipment is inspected (also see DOC 9.7 and DOC 9.8) on a frequency determined by manufacturer’s recommendations [and previous inspections] and that inspection certificates are retained in line with sub section 15.1.3 of the Manual.

9.10.4.2 A UPS is installed outside each secure area and their operation and working are outside the scope of this ISMS other than to state that they are available and operational as a ‘fail over’ power supply. The Information Security Manager has assessed the risk of their failure and prepared the OWI in Appendix III to address the Risk associated with this system.

9.10.5 Cabling security [ISO 17799 clause 9.2.3]

9.10.5.1The Information Security Manager has a site map that identifies all network cabling and all incoming power and all lines are protected.

9.10.5.2Network cabling is protected from unauthorized access by virtue of this being a closed network and power and network cables are segregated using separate conduits and clearly marked for ease of maintenance on the site map.

9.10.5.3Connections between these are further protected by:
a) Electromagnetic shielding for cables;
e) Technical sweeps and physical inspections that are carried out by the Information Security Manager and/or the Security Administrator to ensure that no unauthorized devices are attached to cables.

9.10.6 Equipment maintenance [ISO 17799 clause 9.2.4] Information Security Manager

9.10.6.1 The Information Security Manager is responsible for ensuring that all equipment on the site is maintained in line with manufacturers’ recommended service intervals and specifications. The Information Security Manager is maintains a schedule of all equipment, showing its due and actual service dates, and retains copies of the service reports, together with fault reports and details of preventative or corrective action (also see DOC 9.7).

9.10.6.2 Only authorized and experienced maintenance personnel and only from suppliers identified on the current signed Asset List are permitted to carry out maintenance at the Trust Centre in line with the policy set out in sub section 11.1 [32] of this manual.

9.10.6.3 Equipment that processes or stores confidential information is serviced only by technicians who have been screened in line with the requirements of 8.1.2 of the Manual is cleaned of confidential information prior to servicing.

9.10.6.4 The Organization’s insurance policy is the responsibility of the Director General of IT and is outside the commitments normally associated with a private enterprise.

Scope

The Organization requires, under sub section 9.2.6 of the Manual, that all removable storage media are clean (which means: it is not possible to read or re-constitute the information that was stored on the device or document) prior to disposal.

Responsibilities

The Information Security Manager is responsible for managing the secure disposal of all storage media in line with this procedure when they are no longer required, and is the Owner of the relationship with Al Falwa Cleaning WLL who is the approved contractor for removing shredded documents.

All Owners (see sub section 7.1.2 [32] of the Manual) of removable storage media are responsible for ensuring that these media are disposed of in line with this procedure.

Procedure [ISO 17799 clause 9.2.6]

Hard disks must be cleared of all software and all Organizational confidential and restricted information prior to disposal or re-use, as set out in clause 5 below.

The Information Security Manager is responsible for the secure disposal of storage media and the disposal of all information processing equipment is routed through his/her office. A log (REC 9.1) is retained showing what media was destroyed, disposed of, and when. The asset inventory is adjusted once the asset has been disposed of.

Hard disks are cleaned by the Security Administrator prior to destruction.

Devices containing confidential information are broken and then burnt prior to disposal and are never re-used.

Devices containing confidential information that are damaged are subject to a risk assessment prior to sending for repair, to establish whether they should be repaired or replaced in which case they are destroyed according to this procedure.

Documents containing confidential and restricted information which are to be destroyed are shredded by their owners, using a shredder with an appropriate security classification. These shredders are located in the ISA Town National Smart Card Centre outside the Trust Centre. The waste is removed by the approved contractor.

The Information Security Manager is the owner of this document and is responsible for ensuring that this procedure is reviewed in line with the review requirements of the ISMS.

Yousif Mohammed Ali Muthanna Yousif Mohammed Abdulla
Site Security Manager Site Security Manager

____________________________ ____________________________

On: On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

10. Communications & Operations Management

10.1. Operational Procedures & Responsibilities

[29] 10.1.1 Documented operating procedures
Operating procedures have been documented, are maintained and are made available to all users who need them
10.1.1.1The Information Security Manager is responsible for documenting all the IT working procedures for system activities related to information processing and communications facilities. The procedures required by the Organisation are listed in DOC 10.1.

10.1.2 Change management

Changes to information processing facilities and systems are controlled

10.1.2.1 The Director General of IT is responsible for ensuring that all requests for significant non-routine changes to Organisational information processing facilities are managed in line with DOC 10.7 and sub section 12.5 below is also relevant.

10.1.3 Segregation of duties

Duties and areas of responsibility are segregated to reduce opportunities for unauthorized or unintentional modification or misuse of organisational assets

10.1.3.1 As far as is practicable and possible, the Organisation segregates duties and areas of responsibility. In particular, the following functions are segregated:

1. Risk Assessment Adlin Hisyamuddin - Information Security Manager, Head PKI [30]
2. Authorisation of Controls Mubarak Abdulla Alhiddi - CSO/CIO
3. Change Initiation Ahmed Essa Abualfath - Computer Security Administrator
4. Change Management Shaikh Salman Mohammed Al-Khalifa – Director General of IT
5. Network Management Khalid Al Othman – Chief, Network
6. Network Administration Khalid Ali Al Jalahma – Network Administrator
7. IT Operations Mohammed Al-Yassi – Director IT Operations
8. Software Development Sameh Abo-El-Ela
9. System Testing Osama Khalid Rafai - Computer Security Administrator
10. Employee Administration Hesham Al-Ghatam - Chief, Personnel & Admin’ Development
11. Asset Purchase Khulood Al-Jassim - Supervisor Administration Service
12. Site/Secure Area Security Adel Khalifa Bu-Alai - Chief of Police in Juffair
13. Site/Secure Area Security Mohammed Hamdan Mohammed - Chief of Police in Isa Town
14. Security Audit Osama Khalid Rafai - Computer Security Administrator
15. PKI Manager Adlin Hisyamuddin - Information Security Manager, Head PKI
16. Physical Site Security Yousif Mohammed Ali Muthanna – Site Security Manager
17. Physical Site Security Yousif Mohammed Abdulla – Site Security Manager

10.1.3.2 Segregation of duties is built into procedures, including the requirement that that the Owner of a procedure or process cannot authorize its modification, withdrawal or release.

10.1.3.3 Activity monitoring, audit trails and management supervision are used to support duty segregation.

10.1.4 Separation of development, test and operational facilities

Development, test and operational facilities are separated to reduce the risks of unauthorized access or changes to the operational system

10.1.4.1 The Organisation’s requirements for separate development, test and operational facilities, and its rules for their use and for the transfer of software to the operational environment are documented in DOC 10.8.

10.2 Third Party Service Delivery Management

Control objective: to implement and maintain the appropriate level of information security and service delivery in line with third party service delivery agreements

10.2.1 Service delivery

The Organization ensures that the security controls, service definitions and delivery levels included in the third party service delivery agreement are implemented, operated and maintained by the third party

10.2.1.1 Third party relationship Owners (see sub section 6.2 [32] and 7.1.2 [32]) are required to ensure that security is maintained through transition periods and for ensuring that external parties deliver services and maintain security in line with their agreements, all as specified in DOC 6.8. [32]

10.2.1.2 The Information Security Manager is responsible for ensuring that external party services are linked into the Organisation’s business continuity framework and arrangements (see Section 14 [32]).

10.2.2 Monitoring and review of third party services
The Organisation regularly monitors and reviews the services, reports and records provided by third parties and carries out regular audits

10.2.2.1 The Organisation has a defined process (DOC 10.9) for managing third party service contracts.

10.2.3 Managing changes to third party services

The Organisation manages changes to the provision of services, including maintaining and improving existing information security policies, procedures and controls, taking account of the criticality of business systems and processes involved and re-assessment of risks, and the procedures for doing this are contained in DOC 6.8. [32]

10.3 System Planning & Acceptance

Control objective: to minimize the risks of systems failures

10.3.1 Capacity management
DOC 10.10 sets out the Organisation’s approach to ensuring that the use of resources is monitored, tuned, and projections made of future capacity requirements to ensure the adequate system performance.

10.3.2 System acceptance
Acceptance criteria for new information systems, upgrades and new versions have been established and suitable tests of the system(s) are carried out during development and prior to acceptance, all as specified in DOC 10.10. rotection

10.4 Protection Against Malicious & Mobile Code

Control objective: to protect the integrity of software and information

10.4.1 Controls against malicious code

Detection, prevention and recovery controls to protect against malicious code and appropriate user awareness procedures have been implemented

10.4.1.1The Organization has a formal policy (DOC 10.11) prohibiting the use of unauthorized software, protecting against the risks associated with obtaining files from or via external networks, and has defined appropriate responsibilities and procedures (DOC 10.12) for dealing with the risks from malicious code.

10.4.2 Controls against mobile code

The execution of mobile code is prohibited in the Trust Centre

10.5 Back-Up

Control objective: to maintain the integrity and availability of information and information processing facilities

10.5.1 Information back-up

Back-up copies of information and software are taken and tested regularly in accordance with the agreed back-up policy below

10.5.1.1 The Organization’s policy is that it acts to maintain the integrity and availability of information and information processing facilities by establishing criteria and routine procedures (in DOC 10.13) to ensure that all the Organization’s information assets are backed up and that there are tested procedures (see Section 14 [32]) for restoring them within an adequate time frame.

10.6 Network Security Management

Control objective: to ensure the safeguarding of information in networks and the protection of the supporting infrastructure

10.6.1 Network controls

Networks are managed and controlled as set out in DOC 10.14, in order to be protected from threats, and to maintain security for the systems and applications using the network, including information in transit

10.6.2 Security of network services

Security features, service levels and management requirements of all network services have been identified and included in the network service level agreement and are managed in line with DOC 10.14.

10.7 Media Handling
Control objective: to prevent the unauthorized disclosure, modification, removal or destruction of assets and interruption to business activities

10.7.1 Management of removable computer media
Procedure DOC 10.15 identifies the controls for the management of removable media.

10.7.2 Disposal of media
Media are disposed of securely and safely when no longer required, in line with DOC 9.11. [32]

10.7.3 Information handling procedures
Procedures for the handling and storage of information are set out in DOC 7.6 [32] and DOC 10.15 to protect this information from unauthorized disclosure or misuse

10.7.4 Security of system documentation
System documentation is protected against unauthorized access, as set out in DOC 10.15.

10.8 Exchanges of Information

Control objective: to maintain the security of information exchanged within an organization and with any external entity

10.8.1 Information exchange policies and procedures

Formal exchange policies, procedures and controls are in place to protect the exchange of information through the use of all types of communication facilities

10.8.1.1 The Organization Internet Acceptable Use Policy (DOC 7.2 [32]), its e-mail usage rules (DOC 7.3 [32]), its information classification procedures (DOC 7.6 [32]), its anti-malware policy (DOC 10.11) and related procedures, and the technological controls implemented as required in all those procedures, protect exchanges of information from interception, unauthorized copying, modification, destruction or mis routing.

10.8.1.2 The wireless user’s addendum to the standard User Agreement (see sub section 11.1 [32] of this Manual) sets out how wireless communication is protected.

10.8.1.3 The mobile phone user’s addendum to the standard User Agreement (see sub section 11.1 [32] of this Manual) sets out how mobile voice communication is protected.

10.8.1.4 The organization has a procedure (DOC 7.11) for secure voice communication at all its sites.

10.8.1.5 The Organization use of cryptographic techniques is controlled under sub section 12.3 [32] below.

10.8.1.6 The Organization has procedures for handling (DOC 10.15), retention (DOC 15.2 [32]) and disposal (DOC 9.11 [32]) of information and related media.

10.8.2 Exchange agreements

Agreements are established in line with DOC 6.8 [32] for the exchange of information and software between the Organization and external parties

10.8.3 Physical media in transit

DOC 9.12 [32] sets out how the Organization ensures that media are protected against unauthorized access, misuse or corruption during transportation beyond the Organization physical boundaries

10.8.4 Electronic messaging
Messaging is outbound only and no inbound email system exists within the CIO Trust Centre

10.8.5 Business information systems

A policy and procedures have been developed and implemented to protect information associated with the interconnection of business information systems.

10.8.5.1 The Organization’s policy is that information should be as widely shared within the Organization as is permitted by its security classification (see DOC 7.6 [32]), that information should have as low a classification as is practical, given its sensitivity, and that information within its interconnected systems should be protected in line with its classification. Procedures (see DOC 10.16) have been developed to implement this policy.

10.9 Electronic Commerce Services
Control objective: to ensure the security of electronic commerce services, and their secure use

10.9.1 Electronic Commerce

Electronic commerce information passing over public networks is protected from fraudulent activity, contract dispute, and unauthorized disclosure and modification as set out in DOC 10.17.

10.9.2 On-line Transactions
Information involved in on-line transactions is protected in line with DOC 10.17 to prevent incomplete transmission, mis-routing, unauthorized message alteration, unauthorized message duplication or replay

10.9.3 Publicly available information

The integrity of information being made available on a publicly available system is protected in DOC 10.17 to prevent unauthorized modification

10.10 Monitoring
Control objective: to detect unauthorized information processing activities

10.10.1 Audit logging

Audit logs recording user activities, exceptions and information security events are produced and kept, in line with DOC 10.18, for a period specified in DOC 15.2 [32] to assist in future investigations and access control monitoring

10.10.2 Monitoring system use

Procedures for monitoring use of information processing facilities have been established in DOC 10.18 and the results of the monitoring activities are reviewed [regularly]

10.10.3 Protection of log information

Logging facilities and log information are protected against tampering and unauthorized access, as required by DOC 10.18
10.10.4 Administrator and operator logs
System administrator and system operator activities are logged as required by DOC 10.18

10.10.5 Fault logging

Faults are logged, analysed and appropriate action taken, all in line with DOC 10.18

10.10.6 Clock synchronization

The clocks of all relevant information processing systems within the organisation are synchronized with an agreed accurate time source as specified in DOC 10.18.

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

11. Access Control

Control objective: to control access to information

[29] 11.1 Business Requirement For Access Control

11.1.1 Access control policy

An access control policy has been established, documented in DOC 11.1, and is reviewed when required in the light of business and security needs. In addition, as the Trust Centre protects National Assets, the following are the physical procedures that must be followed every time the Trust Centre in the National Smart Card Centre in Isa Town is accessed.

Administration Area

When access is required to the Administration Area of the Trust Centre, any two of following five members are required in addition to one of the Police Officers, tasked by Mohammed Hamdan Mohammed, to guard the Trust Centre must supervise their entry, and wait in attendance directly outside the door of the Administration Area until all the people that entered, exit at the same time. No one is ever permitted to enter the Trust Centre Administration Area alone, under any conditions. And no one is permitted to remain in the Trust Centre Administration Area unaccompanied by one of the following personnel:

• Mubarak Abdulla Alhiddi
• Osama Khalid Rafai
• Adlin Hisyamuddin
• Yousif Mohammed Ali Muthanna
• Yousif Mohammed Abdulla

If any of the above personnel are absent they can be represented/replaced by the Director General of IT, or the President of the CIO.

Outer Core

When access is required to the Outer Core Area of the Trust Centre, all three of following members are required in addition to one of the Police Officers, tasked by Mohammed Hamdan Mohammed, to guard the Trust Centre must supervise their entry, and wait in attendance directly outside the door of the Outer Area until all the people that entered, exit at the same time. No one is ever permitted to enter the Trust Centre Administration Area alone, under any conditions. And no one is permitted to remain in the Trust Centre Outer Core Area unaccompanied by all of the following personnel:

• Mubarak Abdulla Alhiddi
• Osama Khalid Rafai
• Adlin Hisyamuddin

If any of the above personnel are absent they can be represented/replaced by the Director General of IT, or the President of the CIO.

Inner Core
When access is required to the Inner Core Area of the Trust Centre, all three of following members are required in addition to one of the Police Officers, tasked by Mohammed Hamdan Mohammed, to guard the Trust Centre must supervise their entry, and wait in attendance directly outside the door of the Outer Area until all the people that entered, exit at the same time. No one is ever permitted to enter the Trust Centre Administration Area alone, under any conditions. And no one is permitted to remain in the Trust Centre Inner Core Area unaccompanied by all of the following personnel:

• Mubarak Abdulla Alhiddi




• Osama Khalid Rafai




• Adlin Hisaymuddin Hisyamuddin




If any of the above personnel are absent they can be represented/replaced by the Director General of IT, or the President of the CIO.

Setting Access Control on the Idendix System

Access to all areas of the Trust Centre is controlled by the Identix biometric locking system on all of the doors. The system is configured according to the policy set out in sub section 11.1 above. Only two people have the username and password to access this system:

• Osama Khalid Rafai




• Adlin Hisyamuddin




The Identix control system is located in the Administration Area of the Trust Centre and as no one can access this area alone, both people will be monitored by one of the other personnel with access rights to the Administration Area. A change log must be signed by the Director General of IT or the President of the CIO to change the access configuration for any of the doors in the Trust Centre.

No changes to this system are permitted without this change control document signed by the Director General of IT or the President of the CIO.

In addition, as part of the monthly controls checking procedure, the Information Security Manager will check the los on the Identix system, print out these logs and sign them to demonstrate that no unauthorised changes have occurred without authorisation.

11.2 User Access Management

Control objective: to ensure authorized users’ access and to prevent unauthorised access to information systems

11.2.1 User registration
There is a formal user registration and de-registration procedure (DOC 11.3 and DOC 11.4) for granting and revoking access to all information systems and services

11.2.2 Privilege management
The allocation and use of privileges is restricted and controlled in DOC 11.3

11.2.3 User password management
The allocation of passwords is controlled through a formal management process as set out in DOC 11.3

11.2.4 Review of user access rights

Management reviews users’ access rights at regular intervals using the formal process as set out in DOC 11.3

11.3 User Responsibilities

Control objective: to prevent unauthorized user access, and compromise or theft of information and information processing facilities

11.3.1 Password use

Users are required (in their User Agreements DOC 11.4) to follow good security practices in the selection and use of passwords

11.3.2 Unattended user equipment

Users are required (in their User Agreements DOC 11.4) to ensure that unattended equipment has appropriate protection

11.3.3 Clear desk and screen policy

The Organisation has adopted a clear desk policy for papers and removable storage media and a clear screen policy for information processing facilities and the requirement for compliance [3] with this policy is set out in DOC 11.4.

11.4 Network Access Control

Control objective: to prevent unauthorized access to networked services

11.4.1 Policy on use of network services
The Organisation’s policy (in DOC 11.7) is that users are only provided with access to the services that they have been specifically authorized to use.

11.4.2 User authentication for external connections

DOC 11.8 sets out the authentication methods that are used to control access by remote users.

11.4.3 Equipment identification in the network

Automatic equipment identification is used as set out in DOC 11.8 as a means to authenticate connections from specific locations and equipment

11.4.4 Remote diagnostic and configuration port protection

Physical and logical access to diagnostic and configuration ports is controlled as required by DOC 11.8.

11.4.5 Segregation in networks

Groups of information services, users and information systems are segregated in the network(s) in line with the requirements of DOC 11.7 and 11.8

11.4.6 Network connection control

The Organization has a single shared network which extends across the organizational boundaries; the Organization restricts the capability of users to connect to the network, in line with the access control policy (DOC 11.1) and requirements of the business applications and as set out in DOC 11.8.

11.4.7 Network routing control

Routing controls have been implemented in line with DOC 11.8 for the Organization networks to ensure that computer connections and information flows do not breach the Organization access control policy as applied to the business applications

11.5 Operating System Access Control

Control objective: to prevent unauthorized access to operating systems

11.5.1 Secure log-on procedure

Access to information systems is controlled by the secure log-on procedure set out in DOC 11.9

11.5.2 User identification and authentication

All users have a unique identifier (user ID) for their personal and sole use, issued in line with the requirements of DOC 11.3, and [a suitable authentication technique] has been chosen to substantiate the claimed identity of a user

11.5.3 Password management system

The password management system set out in DOC 11.3 ensures quality passwords

11.5.4 Use of system utilities

The use of utility programs that might be capable of overriding system and application controls is restricted and controlled as specified in DOC 11.10.

11.5.5 Session time-out

Inactive sessions are shut down in accordance with DOC 11.9 after a defined period of inactivity

11.5.6 Limitation of connection time

Restrictions on connection times are used to provide additional security for high-risk applications, as specified in DOC 11.8.

11.6 Application & Information Access Control

Control objective: to prevent unauthorized access to information held in application systems

11.6.1 Information access restriction

Access to information and application system functions by users and support personnel is restricted in DOC 11.2 in accordance with the access control policy in DOC 11.1

11.6.2 Sensitive system isolation

Sensitive systems have a dedicated (isolated) computing environment as provided in DOC 11.9

11.7 Mobile Computing & Teleworking

Control objective: to ensure information security when using mobile computing and teleworking facilities

11.7.1 Mobile computing and communications

A formal policy is in place and appropriate security measures have been adopted to protect against the risks of using mobile computing and communication facilities

11.7.1.1 The Organization’s mobile computing policy below covers notebook computers, palmtops, (PDAs), laptops, smart phones and mobile phones. The Organization provides mobile computing facilities in order to improve the productivity, flexibility, responsiveness and effectiveness of its operations. The Organization also takes appropriate steps for physical protection (User Agreement DOC 11.4), access controls, cryptography, backups and malware protection for mobile devices and also ensures that users receive appropriate training before they are issued with mobile devices. Users are required to accept in writing (DOC 11.5 and 11.6) specific responsibilities with regard to backups, malware protection and their use of mobile devices, particularly with regard to working in unprotected environments.

11.7.2 Teleworking

Is not permitted in the Trust Centre.

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

12. Information Systems

Information Systems Acquisition, Development & Maintenance

Control objective: to ensure that security is an integral party of information systems

[29]12.1 Security Requirements of Information Systems

12.1.1 Security requirements analysis and specification
Statements of business requirements for new information systems, or enhancements to existing information systems, specify the requirements for security controls.
12.1.1.1 The Organisation carries out a risk assessment (in line with DOC 4.4 [32], and see sub section 4.4 [32]) at the requirements stage of specifying any new information systems, or enhancements to existing systems (irrespective of whether they will be bespoke systems or commercial off the shelf systems). Required controls are identified and the [Head of Procurement] is responsible for ensuring that these controls are integrated into the [purchase decision], specification and purchase contract. The Information Security Manager is responsible for ensuing that required manual controls are designed and implemented.

12.1.1.2 Application controls that ensure correct processing are also (where appropriate) considered at the design stage.

12.1.1.3 Software is subject to testing and formal approval in line with DOC 10.10 [32]; non-compliant products are not accepted.

12.1.1.4 The Organisation accepts products tested and evaluated in line with Appendix V.

12.2 Correct Processing in Applications

Control objective: to prevent errors, loss, unauthorized modification or misuse of information in applications

12.2.1 Input data validation

Data input to applications is provided from an external source and the responsibility of its accuracy is outside this ISMS.

12.2.2 Control on internal processing

Validation checks are incorporated into applications to detect any corruption of information through processing errors or deliberate acts.

12.2.3 Message integrity

Requirements for ensuring authenticity and protecting message integrity in applications have been identified, and appropriate controls identified and implemented

12.2.4 Output data validation

Data output from an application is validated to ensure that the processing of stored information is correct and appropriate to the circumstances

12.3 Cryptographic Controls

Control objective: to protect the confidentiality, authenticity or integrity of information by cryptographic means

12.3.1 Policy on the use of cryptographic controls

The Organisation has a policy on its use of cryptographic controls for protection of its information, as set out below

12.3.1.1 The Organization applies cryptographic controls to secure its confidential communications and information carried beyond its secure logical perimeter, to secure connections from beyond its logical perimeter, and to secure its online business (as required in DOC 10.17 [32]). The Information Security Manager is responsible for maintaining DOC 12.1, which sets out, for each situation in which cryptographic controls are required under this policy, the type and length of the encryption algorithm required, and identifies the precise instructions required to use that cryptographic control. He is responsible for key management and [key generation as set out in DOC 12.1. Each asset Owner, whose information asset falls within the scope of this policy, is responsible for ensuring that the required cryptographic control is applied. The Information Security Manager is responsible for configuration of devices as required by this policy.

12.3.2 Key management

Key management, as documented in DOC 12.2, supports the Organization use of cryptographic techniques

Control objective: to ensure the security of system files

12.4 Security of System Files

12.4.1 Control of operational software

The installation of software on operational systems is controlled by DOC 12.3

12.4.2 Protection of system test data

Test data is selected, protected and controlled in line with DOC 10.10 [32].

12.4.3 Access control to program source code

Access to program source code is restricted in line with DOC 10.15 [32]

12.5 Security in Development & Support Processes
Control objective: to maintain the security of application system software and information

12.5.1 Change control procedures

The implementation of changes is controlled by the use of the formal change control procedures set out in DOC 10.7.

12.5.2 Technical review of applications after operating system changes

When operating systems are changed, business critical applications are reviewed and tested in line with DOC 10.10 [32] to ensure there is no adverse impact on organisational operations or security.

12.5.3 Restrictions on changes to software packages

The Organisation does not seek bespoke modifications to commercial software packages.

12.5.4 Information leakage

Controls are applied to limit the opportunities for information leakage

12.5.4.1 The Organisation regularly monitors personnel and system activities, as well as resource usage in computer systems, as described in sub section 5.1.1 [32] of this manual.

12.5.4.4 Malware, that might give cause covert channels, is controlled through the anti-malware software (see 10.4 [32]) and User Agreements (see 11.2 [32] and 11.3 [32]).

12.5.5 Outsourced software development

The Organization does not outsource software development

12.6 Technical Vulnerability Management
Control objective: to prevent the damage resulting from exploitation of published technical vulnerabilities

12.6.1 Control of technical vulnerabilities
Timely information about technical vulnerabilities of information systems used by the Organisation is obtained, the Organisation’s exposure to those vulnerabilities evaluated, and DOC 12.4 sets out the measures taken to address the associated risks.

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

13. Information Security Incident Management

Control objective: to ensure information security events and weaknesses associated with information systems are communicated in a manner allowing timely corrective action to be taken.

[29] 13.1 Reporting Information Security Events & Weaknesses

13.1.1 Reporting information security events

Information security events must be reported to the Information Security Manager as quickly as possible, as set out in DOC 13.1

13.1.2 Reporting security weaknesses

All employees, contractors and third party users of information systems and services are required by DOC 13.1 to note and report to the Information Security Manager any actual or suspected weaknesses in Organizational systems or services

13.2 Management of Information Security Incidents & Improvements

Control objective: to ensure a consistent and effective approach is applied to the management of information security incidents

13.2.1 Responsibilities and procedures

Management responsibilities and procedures have been established in DOC 13.2 to ensure a quick, effective and orderly response to information security incidents that ensures appropriate corrective or preventative actions, restores normal operations as quickly as possible, and ensures that improvement opportunities are identified and acted upon.

13.2.2 Learning from information security incidents

DOC 13.2 requires the Information Security Manager to quantify and monitor the types, volumes and costs of information security incidents.

13.2.3 Collection of evidence

In all information security incidents, irrespective of whether or not a follow-up action against a person or organization involves legal action (either civil or criminal), evidence is collected, retained and presented as set out in DOC 13.5 to conform to the rules for evidence laid down in the laws of the Kingdom of Bahrain.

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

14. Business Continuity Management

[29]

14.1 Information Security Aspects of Business Continuity Management

Control objective: to counteract interruptions to business activities, to protect critical business processes from the effects of major failures of information systems or disasters and to ensure their timely resumption

14.1.1 Including information security in the business continuity management process
A managed process, set out in DOC 14.1, has been developed and is maintained for business continuity throughout the Organisation; it addresses the information security requirements needed for the Organisation’s business continuity

14.1.2 Business continuity and risk assessment

Events that can cause interruptions to business processes are identified as set out in DOC 14.2, along with the probability and impact of such interruptions, and the risk assessment process (DOC 4.4 [32]) is extended to apply to business continuity risks. These risk assessments drive the business continuity planning framework (DOC 14.3)

14.1.3 Developing and implementing continuity plans including information security

The Organisation’s Business Continuity Plan is developed in line with DOC 14.1 and is set out in DOC 14.3. It enables the Organisation to maintain or restore operations and ensure availability of information at the required level and in the required time scales following interruption to, or failure of, critical business processes

14.1.4 Business continuity planning framework
A single framework (as described in DOC 14.1) of business continuity plans is maintained to ensure that the plan and all its sub-plans are consistent, to consistently address information security requirements, and to identify priorities for testing and maintenance

14.1.5 Testing, maintaining and re-assessing business continuity plans
Business continuity plans are tested and updated regularly, in line with the requirements of DOC 14.4, to ensure that they are up to date and effective

Shaikh Salman Mohammed Al-Khalifa Mohammed Al-Amer
Director General of IT President of CIO

____________________________ _______________________________

On:

08 November, 2007
____________________________ _______________________________

Change history

Issue 1 08 November, 2007 Initial issue

15. Compliance

Control objective: to avoid breaches of any law, statutory, regulatory or contractual obligations, and of any security requirements

[29] 15.1 Compliance With Legal Requirements

15.1.1 Identification of applicable legislation

All relevant statutory, regulatory and contractual requirements and the Organization approach to meet these requirements have been explicitly defined, documented and are kept up to date for
each information system and the Organization

15.1.1.1 All contractual, statutory and regulatory requirements that apply to individual information assets are identified by the asset Owners (see sub section 7.1.2 [32]) and listed alongside the asset itself, in the asset inventory defined in accordance with sub section 7.1.1 [32] above.

15.1.1.2 The Information Security Manager is responsible for creating and maintaining the schedule of the Organization statutory and regulatory information/data and computer-related compliance [3] requirements. The controls and responsibilities necessary to meet these compliance requirements are also identified in this schedule.

15.1.2 Intellectual property rights
Appropriate procedures have been implemented to ensure compliance with legislative, regulatory and contractual requirements on the use of material in respect of which there may be intellectual property rights and on the use of proprietary software products.

15.1.2.1 The Organization has adopted a policy on intellectual property rights compliance which is set out in DOC 15.1.

15.1.2.2 The Organization procedures to implement this policy are contained in DOC 15.3.

15.1.3 Safeguarding of organizational records
The Organization procedure, set out in DOC 15.2 protects important records from loss, destruction and falsification, in accordance with statutory, regulatory, contractual and business requirements

15.1.4 Data protection and privacy of personal information
Data protection and privacy are ensured as required and, where applicable, contractual clauses

15.1.4.1 The Organization Data Protection and Privacy policy is set out in DOC 15.6.

15.1.4.2 The Organization has appointed an Information Security Manager who is responsible for ensuring that the procedures set out in sub sections 15.4 and 15.5 are implemented.

15.1.4.3 The Organization has implemented specific technical measures to protect personal information.

15.1.5 Prevention of misuse of information processing facilities

Users are be deterred from using information processing facilities for unauthorized purposes.

15.1.5.1 Users are only allowed to access Organizational information facilities after they have signed a User Agreement (as required in DOC 11.2 [32]), in which they accept that disciplinary action may be commenced against anyone who abuses access rights or contravenes the Internet Acceptable Use Policy (DOC 7.2 [32]), the e-mail rules (DOC 7.3 [32]) or any other part of the ISMS. A warning about unauthorized access is also displayed at logon, as set out in DOC 11.9 [32].

15.1.5.2 The Organization monitors compliance with these requirements, as described in DOC 7.4 [32] and DOC 10.18 [32].

15.1.6 Regulation of cryptographic controls

Cryptographic controls are used in compliance with all relevant agreements, laws and regulations, as set out in DOC 12.2 [32].

15.2 Compliance With Security Policies & Standards

Control objective: to ensure compliance of systems with organizational security policies and standards [10]

15.2.1 Compliance with security policy and standards

Managers ensure that all documented security procedures and work instructions within their area of responsibility are carried out correctly to achieve compliance with security policies and standards

15.2.1.1 Managers are required, under their job descriptions, to carry out monthly checks to ensure that all security procedures and work instructions within their area of responsibility are being carried out, to identify shortfalls and to take action to ensure that shortfalls are immediately corrected. This action should involve identification of the causes of the non-compliance, an evaluation of the need for action to ensure non-recurrence of the shortfall, a determination of the appropriate action, followed by a review of the action to ensure that it has achieved its objectives. This follows the Organization PDCA approach.

15.2.1.2 Managers are required to document these reviews in accordance with DOC 15.4 as well as the actions required, and responsibilities and timeframes, in the case of shortfalls.

15.2.1.3 These management reviews and any actions arising must be reported in accordance with DOC 15.4 to the independent reviewers (see DOC 6.7 [32])

15.2.2 Technical compliance checking

Information systems are regularly checked for compliance with security implementation standards, and the Organization procedures for managing technical compliance checking are set out in DOC 15.4

15.3 Information Systems Audit Considerations

Control objective: to maximize the effectiveness of and to minimize interference to/from the information systems audit process

15.3.1 Information systems audit controls

Audit requirements and activities involving checks on operational systems are carefully planned as set out in DOC 15.5 and agreed with appropriate management to minimize the risk of disruptions to business processes.

15.3.2 Protection of information systems audit tools
Access to information systems audit tools are protected as required in DOC 15.5 to prevent any possible misuse or compromise

15.4 Compliance & Compliance Checking Procedure

The Organization’s entire ISMS is within the scope of this procedure.

Responsibilities

All personnel connected with the Trust Centre are responsible for ensuring and checking for procedural compliance.

The Information Security Manager is responsible for planning and commissioning technical compliance checking.

Procedure

Management review [ISO 17799 clause 15.2.1]

15.4.3.1 On a monthly basis, the Information Security Manager will review operational conformance with those Organizational policies and procedures that apply to the information assets for which they are responsible/whose Owners report to them. Managers are not responsible for performing or commissioning technical compliance checking.

15.4.3.2 The review must be reported/recorded on the Monthly Trust Centre Operational Report.

15.4.3.3 Where a non-conformance is identified, the manager must determine the cause of the non-conformance, evaluate what action is required to ensure that the non-conformance does not re-occur, determine necessary corrective action (including obtaining any required authorizations) and take the identified action

15.4.3.4 The details of the corrective actions, and confirmation of their successful implementation, should also be recorded in the [review report].

15.4.3.5 Review reports are made available to independent reviewers carrying out independent reviews in line with DOC 6.7 [32].

15.4.3.6 Managers are also responsible for identifying non-conformances in the ordinary course of business and taking appropriate corrective action appropriately.

Technical Compliance Checking [ISO 17799 clause 15.2.2]

15.4.4.1 The Information Security Manager has a schedule of the Organization’s information assets (gathered under DOC 7.1 [32]) and these are prioritized by their value to the Organization.

15.4.4.2 All assets that are Risk Level 2 or above are checked for technical compliance with their documented configuration requirements as part of the monthly audit carried out by the Information Security Manager.

ISO 27001 Auditor

15.4.4.3 The Organization requires that any person/organization who carries out technical compliance checking has been either certified as an ISO 27001 Auditor or is an accredited WebTrust Compliance Auditor.

15.4.4.4 The Information Security Manager approves the technical checking plan put forward by the ISO 27001 Auditor or WebTrust Compliance Auditor and authorizes commencement of the check plan only when satisfied that the testing will not compromise the asset or system being checked.

15.4.4.5 Non conformances are identified and dealt with as described in Section 3, above.

15.4.4.6 New weaknesses or vulnerabilities uncovered as a result of the technical compliance checking are reported in line with DOC 13.1 [32] and dealt with in line with DOC 13.2 [32].

Systems Auditing Procedure

The Organization’s information assets and whole ISMS are within the scope of this procedure.

Responsibilities

The Information Security Manager is responsible for planning systems audit activities. The Information Security Manager is responsible for authorizing audit activity to occur.

Procedure [ISO 17799 clause 15.3.1]

Audit controls

The audit regime and the specific audit requirements will be documented and identified as part of the initial internal audit and will be identified and documented here, once completed. You should refer to the guidance of ISO 17799 clause 15.3.1 in drafting your procedure for this activity.

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

16. Change Management

[29] The Information Security Manager is the Owner of this document and is responsible for ensuring that this policy document is reviewed in line with the review requirements stated above.

A current version of this document is available to all members of staff on request.

This manual was approved by the Board of the CIO Trust Centre on 08 November, 2007 and is issued on a version controlled basis under the signature of the Director General of IT.

Shaikh Salman Mohammed Al-Khalifa Mohammed Al-Amer
Director General of IT President of CIO

____________________________ _______________________________

On:

08 November, 2007 08 November, 2007
____________________________ _______________________________

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

Issue 2 [issue date]

Issue 3 [issue date]

Issue 4 [issue date]

17. Appendix I – Contact List & Details

[29] Operational Roles

1. Risk Assessment & PKI [30] Manager
Adlin Hisyamuddin
Information Security Manager, Head PKI
+973 1 772-6732
+973 3 986-7661
adlinh@cio.gov.bh [34]

2. Authorisation of Controls
Mubarak Abdulla Alhiddi
CSO/CIO

3 Change Initiation.
Ahmed Essa Abualfath
Computer Security Administrator
+973 1 772-6731
+973 3 968-7334
aabualfath@cio.gov.bh [35]

4 Change Management.
Shaikh Salman Mohammed Al-Khalifa
+973 3 968-9898
smalkhalifa@cio.gov.bh [36]

5 Network Management.
Khalid Al Othman
Chief, Network
+973 1 772-6325
+973 3 609-9167
osamarf@cio.gov.bh [37]

6 Network Administration.
Khalid Ali Al Jalahma
Network Administrator
+973 1 772-6729
kaljalahma@cio.gov.bh [38]

7 IT Operations.
Mohammed Al-Yassi
Director IT Operations

8 Software Development.
Sameh Abo-El-Ela
Development Manager

cssoshg@cio.gov.bh [39]
9 System Testing & Security Audit.
Osama Khalid Rafai
Computer Security Administrator
+973 1 772-6325
+973 36099167
osamarf@cio.gov.bh [37]

10 Employee Administration.
Hesham Al-Ghatam
Chief, Personnel & Admin’ Development
+973 1 787-8177
alghatamhe@cio.gov.bh [40]
Asset Purchase
11.
Khulood Al-Jassim
Supervisor Administration Service
+973 1 772-6760
aljassimk@cio.gov.bh [41]

12 Site/Secure Area Security Juffair.
Adel Khalifa Bu-Alai
Chief of Police in Juffair
+973 3 981-1055

13 Site/Secure Area Security Isa Town.
Mohammed Hamdan Mohammed
Chief of Police in Isa Town
+973 3 980-8096

Operational Controlling Roles
1. Digi-CA™ [2] Operating System Root Password Holders
Shaikh Salman Mohammed Al-Khalifa
+973 3 968-9898
smalkhalifa@cio.gov.bh [36]

Mohammed Al-Amer
President of CIO
+973 1 787-8101
+973 3 967-2222
malamer@cio.gov.bh [42]

2. Digi-CA™ Operating System Operation Password holders
Shaikh Salman Mohammed Al-Khalifa
+973 3 968-9898
smalkhalifa@cio.gov.bh [36]

Mubarak Abdulla Alhiddi
CSO/CIO

3. Digi-CA™ Operating System Administrators
Khalid Al Othman
Chief, Network
+973 1 772-6767
alothmank@cio.gov.bh [43]

Khalid Ali Al Jalahma
Network Administrator
+973 1 772-6729
kaljalahma@cio.gov.bh [38]

4. Master Digi-CA™ Administrator
Adlin Hisyamuddin
Information Security Manager
+973 1 772-6732
+973 3 986-7661
adlinh@cio.gov.bh [34]

Ahmed Essa Abualfath
Computer Security Administrator
+973 1 772-6731
+973 3 968-7334
aabualfath@cio.gov.bh [35]

5. Master Digi-CA™ Operator
Osama Khalid Rafai
Computer Security Administrator
+973 1 772-6325
+973 3 609-9167
osamarf@cio.gov.bh [37]

Khalid Ali Al Jalahma
Network Administrator
+973 1 772-6729
kaljalahma@cio.gov.bh [38]

6. Digi-CA™ RA Administrator
Saud Abdulaziz Bahzad
Smart Card Support
+973 3 903-3319
soudbah@cio.gov.bh [44]

Sameh Abo-El-Ela
Smart Card Technical
+973 1 772-6704
+973 3 6439376
cssoshg@cio.gov.bh [39]

7. Digi-CA™ Control Centre Operator

Isa Town Card Issuer No. 1 - to be selected by Adlin

Isa Town Card Issuer No. 2 - to be selected by Adlin

Key Ceremony Roles

1 Key Ceremony Administrator (& future Master of Ceremonies).
Adlin Hisyamuddin
Information Security Manager, Head PKI
+973 1 772-6732
+973 3 986-7661
adlinh@cio.gov.bh [34]

1. 1st Witness.
Osama Khalid Rafai - Computer Security Administrator
+973 1 772-6325
+973 3 609-9167
osamarf@cio.gov.bh [37]

3. 2nd Witness.
Elham Moh’d Saleh
Director Technical Resources
+973 17878017
elhama@cio.gov.bh [45]

4. Key Holder No. 1.
Shaikh Salman Mohammed Al-Khalifa
+973 3 968-9898
smalkhalifa@cio.gov.bh [36]

5. Key Holder No. 2.
Mubarak Abdulla Alhiddi
Senior Population Inspector – Supervisor
+973 39655366
monamj@cio.gov.bh [46]

6. Key Holder No. 3.,/h7>
Yousif Abdulla Ashoor
Senior Population Inspector – Clerk
+973 39457566
yashoor@cio.gov.bh [47]

7. Key Holder No. 4 - Ahmed Abdulmonem Alshami.
Ahmed Abdulmonem Alshami
Smart Card Support
+973 39537089
alshamyah@cio.gov.bh [48]

8. Key Holder No. 5 - Razan Abdulrahman Al Khalifa.
Razan Abdulrahman Al Khalifa
Smart Card Support
+973 39456565
razanaak@cio.gov.bh [49]

9. Member No.1 Security World.
Shaikh Salman Mohammed Al-Khalifa
+973 3 968-9898
smalkhalifa@cio.gov.bh [36]

10. Member No.2 Security World.
Mubarak Abdulla Alhiddi

11. Member No. 3 Security World.
Ahmed Al Mahmood
Director of Population Registry
+973 39672677
aalmahmood@cio.gov.bh [50]

13 Member No. 4 Security World.

14 Member No. 5 Security World.

HSM Configuration Roles

1. Key Ceremony Administrator (& future Master of Ceremonies)
Adlin Hisyamuddin
Information Security Manager, Head PKI
+973 1 772-6732
+973 3 986-7661
adlinh@cio.gov.bh [34]

2. 1st Witness.
Osama Khalid Rafai - Computer Security Administrator
+973 1 772-6325
+973 3 609-9167
osamarf@cio.gov.bh [37]

3. 2nd Witness.
Elham Moh’d Saleh
Director Technical Resources
+973 17878017
elhama@cio.gov.bh [45]

4. Member No.1 Security World.
Mubarak Abdulla Alhiddi

11. Member No. 3 Security World.
Ahmed Al Mahmood
Director of Population Registry
+973 39672677
aalmahmood@cio.gov.bh [50]

13. Member No. 4 Security World.

14. Member No. 5 Security World.

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

17. Appendix II – Inventory of Assets, Suppliers & Authorities

[29] Hardware

The Information Security Manager is the owner of this document and is responsible for ensuring that it is maintained by the relationship owners

This document was issued by the Information Security Manager on 08 November, 2007 and is issued on a version controlled basis.

Adlin Hisyamuddin
Information Security Manager

____________________________

On:

08 November, 2007
____________________________

Change history

Issue 1 08 November, 2007 Initial issue

Software