MUSC Policy MUSC-xx: Information Security Documentation
- Refer to MUSC Policy MUSC-xx: Information Security: Appendix A.
Information security management processes at MUSC must be documented. The types of processes that must be documented include: risk assessments, risk management actions, and changes to security policies and procedures:
- System Owners are responsible for documenting their risk assessments.
- Management is required to document its risk management actions.
- The maintainer of a security policy or procedure is required to document changes to the policy or procedure.
In each case, the person responsible for the documentation must ensure that the documentation is (a) made available as needed to all authorized personnel, (b) periodically reviewed, (c) updated as needed in response to environmental or operational changes, and (d) retained for a minimum of six years.
- Refer to MUSC Policy MUSC-xx: Information Security: Sanctions.
- MUSC Policy MUSC-xx: Information Security
- MUSC Policy MUSC-xx: Information Security - Risk Management
- MUSC Policy MUSC-xx: Information Security - Evaluation
- HIPAA Security 164.316(b)(1) Standard: Documentation
- GLBA Safeguards Rule: 314.3(a)
$Id: documentation.html,v 1.7 2004/12/10 19:45:52 gadsden Exp $