1. Explain the concept of EISP with example.

An Enterprise Information Security Policy sits atop the company's

security efforts. In fact, it details what a company's philosophy is on security
and helps to set the direction, scope, and tone for all of an organization's
security efforts. It is a management-level document; that means, it is most
likely written by the company's chief information officer or someone serving
in that capacity. The EISP, as it's known for short, explains what the
company believes about security, the different types of roles that exist in the
company's security arena (and the duties of each) and what responsibilities
all employees have for keeping the organization's systems and information
safe from intrusion. It can also be used as a roadmap for future security
program development by setting the tone for how the company treats
security matters. Unlike other security policies in an organization that must
be modified as new technologies present themselves, the EISP is typically
final once completed - with very few changes going forward. An EISP will
vary from one company to another to meet the purpose of the organization
itself. For example, a hospital that handles a lot of sensitive patient data in
electronic form may specify as one of its EISP goals to safeguard against
authorized access or accidental dissemination. In this way, it is possible to
integrate the mission and objectives of the organization into its EISP by
defining specific security measures that can enhance and further the
organization's purpose.
 Protection of Information: Information must be protected in a manner
commensurate with its sensitivity, value, and criticality
 Use of Information: Company X information must be used only for the
business purposes expressly authorized by management
 Information Handling, Access, and Usage: Information is a vital asset and all
accesses to, uses of, and processing of Company X information must be
consistent with policies and standards
 Data and Program Damage Disclaimers: Company X disclaims any
responsibility for loss or damage to data or software that results from its
efforts to protect the confidentiality, integrity, and availability of the
information handled by computers and communications systems
 Legal Conflicts: Company X information security policies were drafted to
meet or exceed the protections found in existing laws and regulations, and
any Company X information security policy believed to be in conflict with
existing laws or regulations must be promptly reported to Information
Security management