Charlie Moody called the meeting to order. The conference room was full of developers, systems analysts, and IT managers, as well as staff and management from sales and other departments. “All right everyone, let’s get started. Welcome to the kick-off meeting of our new project team, the Sequential Label and Supply Information Security Task Force. We’re here today to talk about our objectives and to review the initial work plan.” “Why is my department here?” asked the manager of sales. “Isn’t security a problem for the IT department?” Charlie explained, “Well, we used to think so, but we’ve come to realize that information security is about managing the risk of using information, which involves almost everyone in the company. In order to make our systems more secure, we need the participation of representatives from all departments.” Charlie continued, “I hope everyone read the packets we sent out last week describing the legal requirements we face in our industry and the background articles on threats and attacks. Today we’ll begin the process of identifying and classifying all of the information technology risks that face our organization. This includes everything from fires and floods that could disrupt our business to hackers who might try to steal or destroy our data. Once we identify and classify the risks facing our assets, we can discuss how to reduce or eliminate these risks by establishing controls. Which controls we actually apply will depend on the costs and benefits of each control.” “Wow, Charlie!” said Amy Windahl from the back of the room. “I’m sure we need to do it— I was hit by the last attack, just as everyone here was—but we have hundreds of systems.” “It’s more like thousands,” said Charlie. “That’s why we have so many people on this team, and why the team includes members of every department.” Charlie continued, “Okay, everyone, please open your packets and take out the project plan with the work list showing teams, tasks, and schedules. Any questions before we start reviewing the work plan?” As Charlie wrapped up the meeting, he ticked off a few key reminders for everyone involved in the asset identification project. “Okay, everyone, before we finish, please remember that you should try to make your asset lists complete, but be sure to focus your attention on the more valuable assets first. Also, remember that we evaluate our assets based on business impact to profitability first, and then economic cost of replacement. Make sure you check with me about any questions that come up. We will schedule our next meeting in two weeks, so please have your draft inventories ready.” Give reasons for possible resistance by some attendees to the goals of the meeting. How was each invite person invited briefed on the importance of the event and the issues behind it?
CASE STUDY
Charlie Moody called the meeting to order. The conference room was full of developers,
systems analysts, and IT managers, as well as staff and management from sales and other
departments.
“All right everyone, let’s get started. Welcome to the kick-off meeting of our new project
team, the Sequential Label and Supply
talk about our objectives and to review the initial work plan.”
“Why is my department here?” asked the manager of sales. “Isn’t security a problem for the
IT department?”
Charlie explained, “Well, we used to think so, but we’ve come to realize that information
security is about managing the risk of using information, which involves almost everyone in
the company. In order to make our systems more secure, we need the participation of representatives from all departments.”
Charlie continued, “I hope everyone read the packets we sent out last week describing the
legal requirements we face in our industry and the background articles on threats and
attacks. Today we’ll begin the process of identifying and classifying all of the information
technology risks that face our organization. This includes everything from fires and floods
that could disrupt our business to hackers who might try to steal or destroy our data. Once
we identify and classify the risks facing our assets, we can discuss how to reduce or eliminate
these risks by establishing controls. Which controls we actually apply will depend on
the costs and benefits of each control.”
“Wow, Charlie!” said Amy Windahl from the back of the room. “I’m sure we need to do it—
I was hit by the last attack, just as everyone here was—but we have hundreds of systems.”
“It’s more like thousands,” said Charlie. “That’s why we have so many people on this team,
and why the team includes members of every department.”
Charlie continued, “Okay, everyone, please open your packets and take out the project plan
with the work list showing teams, tasks, and schedules. Any questions before we start
reviewing the work plan?”
As Charlie wrapped up the meeting, he ticked off a few key reminders for everyone involved
in the asset identification project.
“Okay, everyone, before we finish, please remember that you should try to make your asset lists
complete, but be sure to focus your attention on the more valuable assets first. Also, remember
that we evaluate our assets based on business impact to profitability first, and then economic
cost of replacement. Make sure you check with me about any questions that come up. We will
schedule our next meeting in two weeks, so please have your draft inventories ready.”
Give reasons for possible resistance by some attendees to the goals of the meeting. How was each invite person invited briefed on the importance of the event and the issues behind it?
Trending now
This is a popular solution!
Step by step
Solved in 2 steps
