Departmental Risk Assessment Coordinators (DRAC) - PowerPoint Presentation

Slide1

Departmental Risk Assessment Coordinators (DRAC)ProgramCUVA ConferenceMay 23, 2012Mason InnGeorge Mason University

Robert

Nakles

and Josh Schiefer

IT Security Office

George Mason University

Presentation OverviewPurpose of the DRAC ProgramState RequirementsUniversity ResponseReview of DRAC ProgramKey ComponentsThe Role of the DRACThe RA ProcessProgram Management

Current Status

Lessons Learned and Future Plans

State RequirementsInformation Security Standard SEC501-062.6 Risk AssessmentFor sensitive IT system, not less than every 3 years4.2 IT System Security PlanDocuments security controlsBased on results of the risk assessmentIT Risk Management Guideline SEC506-01

6.2 Risk Assessment Process

At least, once every 3 years, unless “substantial change”

University ResponseIn distributed environment, discover sensitive systemsCentrally managed systems and departmentsHow is access controlledHow is data managedBusiness processes that impact sensitive systemsInvolve knowledgeable staff within departments

DRAC ProgramPurpose: to provide university departments with the framework and resources necessary to complete a required risk assessment for information technology (IT) security within their individual environments. Each department will appoint one or more Departmental Risk Assessment Coordinator or DRAC to conduct the IT risk assessment and develop an appropriate security plan.Helps each department come to terms with what risk they have

The Role of the DRACA successful Departmental Risk Assessment Coordinator (DRAC) is someone who knows the business processes of his or her unit, department or office and has been authorized by the department head to act on his or her behalf.The DRAC facilitates the completion of a risk assessment and security plan in a 3 year period of time. 

Profile of a DRACWho is a DRAC?Appointed by dean or vice presidentExamples of DRACS

The Risk AssessmentThe risk assessment questionnaire consists of a Business Impact Analysis and a series of security questions based upon industry “best practices,” university policies and applicable federal regulations. The security plan is a documented response to the risks identified during the completion of the questionnaire.

Program ManagementThe Information Technology Security Office provides resources and procedures for each DRAC so they can complete the risk assessment accurately and develop a practical security plan. Cohort based: Each DRAC is placed into a cohort based on risk level and/or similar business function. Meet quarterly.myMason: projects updates, exchange documents, scheduling, e-mail communications, etc.

Current Status2 Cohorts working nowCohort A: administrative units Active since April 2010Cohort B: academic space Active since August 2010

Lessons LearnedGetting the right DRAC not always easyAcademic space presents different challenges than the administrative. Research space even more difficult to hands around.TurnoverManaging ExpectationsResource intensive

Next StepsAdd additional CohortsRefine processOverhaul QuestionnaireUtilize MyMason Portal morePaper less

Questions?Contact informationJosh Schiefer(703) 993-9893Email: jschiefe@gmu.eduBob

Nakles

(703) 993-2975

Email: rnakles@gmu.edu

DRAC Web site

security.gmu.edu