Sche| **Privileg| **BCDR Testing a| **| **| **Workforce Screening and Background Check Procedure** (OP-PROC-006) | Human Resources (HR) | Outlines the formal process for conducting mandated background checks on all candidates for employment. |obile Device Onboarding and Security Configuration Procedure** (OP-PROC-002) | IT Security Team | Details the steps for enrolling a mobile device in the MDM system and ensuring it meets security mandates. |IPAA Breach Risk Assessment Procedure** ([RES-PROC-002]) | Privacy Officer | Guides the formal risk assessment mandated to determine if an incident qualifies as a notifiable HIPAA breach. |d Exercise Procedure** ([RES-PROC-007]) | Business Continuity Manager | Details the mandates for planning and executing the annual disaster recovery tests and business continuity exercises. |d Infrastructure Access Review Procedure** (ENG-PROC-006) | Security Team | Outlines the steps for conducting and documenting the mandated quarterly reviews of all user accounts with privileged access. |ule of Security Procedures (ISMS-SUP-001)
Quarterly Procedures
These procedures shall be conducted and documented every three months to ensure ongoing compliance and security posture management.
| Procedure (Code) | Primary Owner | Description |
|---|---|---|
| Information Security Committee Charter Procedure (SEC-PROC-001) | Committee Chair | Defines the operating rules and responsibilities of the Information Security Committee, which holds quarterly meetings. |
| Facility Access Management Procedure (SEC-PROC-006) | Facilities/Security Team | Describes the process for managing physical facility access, including conducting and documenting quarterly access reviews. |
| User Access Review Procedure (AC-PROC-003) | IT/Security Team | Defines the process for conducting periodic reviews of user access rights to ensure adherence to the principle of least privilege. |
| Privileged Infrastructure Access Review Procedure (ENG-PROC-006) | Security Team | Outlines the steps for conducting and documenting the required quarterly reviews of all user accounts with privileged access. |
Annual Procedures
These procedures shall be performed at least once per year to satisfy major compliance, assessment, and testing mandates.
| Procedure (Code) | Primary Owner | Description |
|---|---|---|
| Internal Audit Procedure (SEC-PROC-002) | Head of Internal Audit | Outlines the process for planning, conducting, and reporting on annual internal audits of the Information Security Management System. |
| Risk Assessment Procedure (SEC-PROC-004) | Security Officer | Establishes a systematic process for conducting risk assessments annually and on an ad-hoc basis when significant changes occur. |
| Incident Response Plan (IRP) ([RES-PROC-001]) | Security Team | Provides actionable steps for responding to incidents, including conducting annual training and simulation exercises. |
| Business Impact Analysis (BIA) Procedure ([RES-PROC-004]) | Business Continuity Manager | Defines the methodology for conducting the annual Business Impact Analysis to identify critical functions and establish recovery objectives. |
| BCDR Testing and Exercise Procedure ([RES-PROC-007]) | Business Continuity Manager | Details the requirements for planning and executing the annual disaster recovery tests and business continuity exercises. |
| Cryptographic Key Lifecycle Management Procedure (OP-PROC-001) | Security Engineering Team | Provides technical steps for the secure lifecycle of cryptographic keys, including their annual rotation. |
| Application Security Testing Procedure (ENG-PROC-001) | Security Team | Details the process for conducting security testing, including annual penetration tests for applications handling sensitive data. |
Ad-Hoc / As-Needed / Event-Driven Procedures
These procedures are not performed on a fixed schedule but are triggered by specific events such as a new hire, a security incident, or a request for a new system.
| Procedure (Code) | Primary Owner | Description |
|---|---|---|
| Password Policy Exception Procedure (SEC-PROC-003) | Security Officer | Provides a formal process for requesting, reviewing, and documenting exceptions to the Password Policy. |
| Vendor Risk Assessment and Onboarding Procedure (SEC-PROC-005) | Security Team | Details the process for assessing a new vendor’s security posture before engagement. |
| AI Tool Risk Assessment and Approval Procedure (SEC-PROC-007) | AI Governance Committee | Defines the process for performing a risk assessment on new AI tools before they are approved for use. |
| Vulnerability Management Procedure (SEC-PROC-008) | Security Team | Describes the continuous workflow for identifying, prioritizing, remediating, and verifying system vulnerabilities. |
| Vulnerability Management Exception Procedure (SEC-PROC-009) | Security Officer | Outlines the process for formally requesting and documenting an exception to a vulnerability remediation Service Level Agreement (SLA). |
| Acceptable Use Policy Violation Investigation Procedure (AC-PROC-001) | Security Officer | Defines the process for investigating and responding to reported violations of the acceptable use policy. |
| Bring Your Own Device (BYOD) Onboarding Procedure (AC-PROC-002) | IT Department | Establishes the process for registering and securing a personally-owned device for access to company resources. |
| Access Control Management Procedure (AC-PROC-004) | IT Department | Defines the process for managing the lifecycle of user access, including provisioning, modification, and revocation. |
| HIPAA Breach Risk Assessment Procedure ([RES-PROC-002]) | Privacy Officer | Guides the formal risk assessment required to determine if an incident qualifies as a notifiable HIPAA breach. |
| Post-Incident Review Procedure ([RES-PROC-003]) | Incident Commander | Outlines the process for conducting a formal ‘lessons learned’ review after a significant incident is resolved. |
| IT Disaster Recovery Plan (DRP) ([RES-PROC-005]) | BCDR Steering Committee | Provides technical procedures for recovering IT infrastructure in the event of a declared disaster. |
| Business Continuity Plan (BCP) ([RES-PROC-006]) | BCDR Steering Committee | Outlines procedures for activating emergency response and continuing critical business functions during a disruption. |
| Mobile Device Onboarding and Security Configuration Procedure (OP-PROC-002) | IT Security Team | Details the steps for enrolling a mobile device in the MDM system and ensuring it meets security requirements. |
| Lost or Stolen Mobile Device Response Procedure (OP-PROC-003) | IT Security Team | Provides the immediate steps to take when a mobile device used for company business is reported lost or stolen. |
| Secure Media Disposal and Sanitization Procedure (OP-PROC-004) | IT Team | Provides instructions for securely destroying or sanitizing media that is at the end of its lifecycle. |
| Legal Hold Procedure (OP-PROC-005) | Legal Team | Outlines the steps for issuing, tracking, and releasing a legal hold on information relevant to legal matters. |
| Workforce Screening and Background Check Procedure (OP-PROC-006) | Human Resources (HR) | Outlines the formal process for conducting required background checks on all candidates for employment. |
| Employee Onboarding and Offboarding Security Procedure (OP-PROC-007) | Human Resources (HR) | Provides a formal checklist to ensure all security tasks are completed during employee onboarding and termination. |
| Security Policy Sanction Procedure (OP-PROC-008) | Manager & HR | Describes the process for documenting security policy violations and applying appropriate disciplinary actions. |
| Third-Party Component Security Review Procedure (ENG-PROC-002) | Development Team Lead | Defines the steps for reviewing and approving the use of new third-party software components. |
| Standard Change Management Procedure (ENG-PROC-003) | Engineering Lead | Details the process for managing a standard, non-emergency change to a production application or configuration. |
| Emergency Change Management Procedure (ENG-PROC-004) | Engineering & Security Teams | Outlines the expedited process for authorizing and deploying an emergency change to resolve a critical issue. |
| System Hardening and Baselining Procedure (ENG-PROC-005) | Security Team | Describes the process for applying security baselines to new systems and verifying their ongoing compliance. |