IT Risk Management - Regional Gardens | Study

Running head: IT RISK MANAGEMENT
IT Risk Management: Regional Gardens
Name of the Student
Name of the University
Author’s Note:

1
IT RISK MANAGEMENT
Table of Contents
1. Brief Overview.......................................................................................................................2
2. Policy Purpose and Rationale.................................................................................................2
2.1 Defining the Intent and Rationale of the Policy...............................................................2
3. Policy Scope...........................................................................................................................3
3.1 Defining the Scope of the Policy i.e. who and what it effects.........................................3
4. Roles and Responsibilities.....................................................................................................3
4.1 Defining the Responsibilities of Individuals affected by the Policy, including those
responsible for enforcing the policy as well as those who are affected by the policy...........3
5. Mandatory Requirements.......................................................................................................5
5.1 Inclusion of the Mandatory Requirements for the Rules or Actions that are Reasonable
for placing into the Policy to meet its Intent and Rationale...................................................5
6. Exemptions.............................................................................................................................6
6.1 Inclusion of any Exemption that is reasonable for placing into the Policy to meet its
Intent and Rationale...............................................................................................................6
7. Glossary..................................................................................................................................6
References..................................................................................................................................7

2
IT RISK MANAGEMENT
1. Brief Overview
Regional Gardens Ltd is a popular organization, which runs a number of associated
gardening enterprises. It comprises of a large display garden, which it opens for the purpose
of public inspection, several times in 1 year. The organization even owns the Regional
Gardens Nursery and Regional Gardens Planners. They have a small data centre as the main
site in Bathurst, in which the data storage and servers of the organization are located. The
organization comprises of a range of various types of relatively old personal computers that
run on Windows 7 Enterprise for connecting to the organizational data centre. Moreover, this
particular organization uses different servers for conducting their core business and all of
their servers are independent machines with relatively vanilla installations of the operating
systems.
Most of the staff have access to the desktops and servers and has a haphazard
tendency regarding server administration. Several unused accounts are present and the
external hackers have compromised few desktop machines previously. Furthermore, they do
not have a firewall as well as security system and backup or disaster recovery system. They
do not have proper network security since the servers are present on the same networks. As a
result, it is extremely important and significant to ensure that a data integrity policy is present
in the organization of Regional Gardens for better safety and security of the organizational
servers and data.
2. Policy Purpose and Rationale
2.1 Defining the Intent and Rationale of the Policy
The major purpose of the data integrity policy in Regional Gardens Ltd. is to set a
globalized standard for overall maintenance of the paper records and the electronic data
within the company and even to bring out major transparency in every activity of data
transfer [1]. Moreover, this particular policy is required for meting each and every regulation
and also ensure massive compliance with the data security aspects or data risk management.
The management of Regional Gardens would be highly benefitted with this particular policy
as it would provide proper efficiency in understanding and identifying the consequences of
the breach of data integrity. The data integrity policy would be providing basic control to the
organizational management for ensuring that better effectiveness and efficiency is gained in
the business without much complexity [2].

3
IT RISK MANAGEMENT
Since, Regional Gardens do not have any type of security in their network and
servers, it would be extremely effective for them to maintain quality in the product and
service. It would be responsible for incrementing the chance of business with digital
economy. The rational of the data integrity policy in this particular organization is to reflect
on the core values as well as commitment of the organization for understanding the major
aspects of data security, so that accuracy and reliability of the data is being obtained under
every circumstance. It is also required for ensuring recoverability, traceability and search
ability of the data to improve maintainability and reusability effectively without much
complexity [3]. Data integrity has been compromised in different methods by the external
hackers in Regional Gardens Ltd and hence it is extremely important and significant for the
organizational to ensure that the data remains unaltered and intact under every circumstance
and validation is maintained effectively.
3. Policy Scope
3.1 Defining the Scope of the Policy i.e. who and what it effects
The scope of the data integrity policy in Regional Gardens Ltd would be ensuring
accuracy, reliability as well as consistency of their stored data in the servers for the entire life
cycle [4]. This type of integrity is being indicated by the absence of data alteration within 2
distinct records of data at various time instants. The standard rules and processes are being
followed for proper assurance of data integrity and could be maintained by the utilization of
validation protocol, periodic auditing and even access management.
The policy would be affecting all the staff in the organizational departments of system
administration, management and administration and would be important each and every staff
of the other departments [5]. This type of integrity would be extremely beneficial for few
significant reasons like key business processes being managed through electronic control
system, increase in the usage of procedures for interaction within computerized systems like
Internet, mobile devices, wireless system and many more. Furthermore, the management
would be able to increase the data security from end to end transfer on the transmission
medium.
4. Roles and Responsibilities

4
IT RISK MANAGEMENT
4.1 Defining the Responsibilities of Individuals affected by the Policy, including those
responsible for enforcing the policy as well as those who are affected by the policy
The three departments of administration, management and administration in Regional
Gardens would be affected by the data integrity policy. Data integrity refer to the subsequent
trustworthiness and reliability of the data in the data life cycle [6]. It could even describe the
data state, i.e. whether it is invalid or valid and even the procedure to ensure and preserve the
accuracy and validity of the data. The organizational management require to make different
data driven business decisions as well as data without integrity, so that the objectives and
goals are obtained without much complexity. The major threats of data integrity include
unintended transfer errors, security issues, insider threats, cyber-attacks, misconfigurations
and many more [7]. The data integrity analyst ensures that organizational employees utilize
internal information sources properly, so that they are able to reduce the complexities related
to data security and integrity. Moreover, data validation and backup is also considered on top
priority for this purpose. The duplicate data are removed and there exists chance of access
control to a high level. The stored processes could be utilized with an ease for having the
complete control of data accessibility [8]. There are some of the most important and
significant responsibilities of the individuals, who are affected by the policy majorly.
i) Department of System Administration: The entire department of system
administration is responsible for establishing and deploying different systems, which make
sure that the transactions are being properly authorized as well as recorded in the most
accurate manner within the organization of Regional Gardens [9]. The main principles
include data models containing control for ensuring that the respective data is synchronized
or reconciled in between the operating units and systems becoming secured, stable,
accessible, responsive and reliable and fulfilling the user requirements. One of the most
significant responsibilities of system administration department for data integrity policy
would be ensuring that the organizational systems and servers are being segregated properly,
so that the employees have access control and no employee is allowed to control over the key
processing functionalities like recording and authorization of transactions in the most
effective manner [10]. The support of the post authorization review is also being considered
on top priority for ensuring that data integrity is being maintained for these systems and
servers.
ii) Department of Administration: Apart from the system administration department,
the administration department are also affected by the data integrity policy in Regional

5
IT RISK MANAGEMENT
Gardens Ltd. They would be responsible to manage the organizational computer’s data by
considering the data security [11]. For ensuring that the data is being handled properly by the
most authenticated parties, they would be tracking the records for indicating that who is
accessing the information held by the organizational computer systems at respective time.
Proper reviewing and analysis of the information would be effective for them to protect the
organizational data reserves. The department would also have the responsibility of ensuring
that the security systems and firewalls are upgraded and secured from the ever changing
methodologies of data management.
iii) Department of Management: The entire department of management in Regional
Gardens is enforcing the data integrity policy. Since they will be making the entire policy, it
is extremely important and significant for them to ensure that they are following integrity
practices effectively. Moreover, it is required that all the employees at every level to
understand their major roles and responsibilities for ensuring data integrity within the
business [12]. The employees in Regional Gardens would be facing circumstances, if any
type of violation would be noted in their work. The management could enforce the data
integrity within the business, after performing proper reviewing of the audit trails.
5. Mandatory Requirements
5.1 Inclusion of the Mandatory Requirements for the Rules or Actions that are
Reasonable for placing into the Policy to meet its Intent and Rationale
There are some of the significant and noteworthy requirements for the actions and
rules in the data integrity policy for meeting the purpose and rationale. The rules, required for
the data integrity policy in Regional Gardens Ltd are as follows:
i) Maintenance of Confidentiality: The first and the foremost important and
significant rule that would be highly reasonable to be placed into the respective data integrity
policy for meeting the purpose and rationale is maintenance of data confidentiality [13]. Each
and every employee should maintain data confidentiality to the third parties about any type of
business related data or information, so that the data does not get lost under any circumstance
and major effectiveness and efficiency is being gained in Regional Gardens Ltd. As they do
not have any firewall or security system currently in the business, this particular rule would
be extremely vital for their servers and systems.
ii) Ensuring Data Quality: The next vital and noteworthy rule that would be highly
reasonable to be placed into the respective data integrity policy for meeting the purpose and

6
IT RISK MANAGEMENT
rationale is ensuring data quality. It would be quite important for the organization of Regional
Gardens to ensure high quality of data is being prevailed and redundant data is absent
completely. As a result, data validation would be possible for the systems and servers and
hence involving high chances of data integrity and security.
iii) Up Gradation of Systems and Servers: The organizational management of
Regional Gardens would have to periodically upgrade their systems and servers, for ensuring
that the data is not lost and is updated at every situation [14]. It would make sure that the
respective servers and systems would be having a backup system or data recovery and hence
avoiding data loss as well as unintentional change in the information.
The actions, required to be undertaken for the data integrity policy in Regional
Gardens Ltd are as follows:
i) High Penalty to the Employees: The first and the foremost important and
significant action that would be highly reasonable to be placed into the respective data
integrity policy for meeting the purpose and rationale is giving high penalty to the employees
and staff [15]. If any of those 65 staff are found to be violating the above mentioned rules of
data integrity, he or she would be highly penalized in the first attempt.
ii) Suspension of the Employees: The second significant and vital action that would
be highly reasonable to be placed into the respective data integrity policy for meeting the
purpose and rationale is temporary suspension of the employees. If the respective employee
does not follow data integrity, he or she would be suspended for a certain time period.
iii) Termination of the Employees: The final action that is to be taken by the
organizational management would be permanent termination of the employee.
6. Exemptions
6.1 Inclusion of any Exemption that is reasonable for placing into the Policy to meet its
Intent and Rationale
The first exemption, which is reasonable to place into the policy for meeting its intent
and rationale is systems under development and the experimental systems, which do not
create any type of IT risk to the systems and servers of Regional Gardens [16]. Another
significant exemption to this data integrity policy is the redundant data and different extra and
retired systems in the business.

7
IT RISK MANAGEMENT
7. Glossary
i) Data Integrity: It is the maintenance and assurance of consistency and accuracy of
the data for its entire life cycle. It is a critical aspect for the design and implementation of a
system for data retrieval.
ii) Security Policy: It is a written document for a company that outlines the process of
organizational protection from different threats and process to handle the situation, when they
take place.

8
IT RISK MANAGEMENT
References
[1] M. Siponen, M.A. Mahmood and S. Pahnila. Employees’ adherence to information
security policies: An exploratory field study. Information & management, 51(2), pp.217-224.
2014.
[2] T.R. Peltier. Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. Auerbach Publications. 2016.
[3] N.S. Safa, R. Von Solms and S. Furnell, Information security policy compliance model in
organizations. computers & security, 56, pp.70-82. 2016.
[4] M. Salnitri, F. Dalpiaz and P. Giorgini. Modeling and verifying security policies in
business processes. In Enterprise, Business-Process and Information Systems Modeling (pp.
200-214). Springer, Berlin, Heidelberg. 2014.
[5] Y. Yu, M.H. Au, G. Ateniese, X. Huang, W Susilo, Y. Dai and G. Min. Identity-based
remote data integrity checking with perfect data privacy preserving for cloud storage. IEEE
Transactions on Information Forensics and Security, 12(4), pp.767-778. 2016.
[6] C. Liu, C. Yang, X. Zhang and J. Chen. External integrity verification for outsourced big
data in cloud and IoT: A big picture. Future generation computer systems, 49, pp.58-67.
2015.
[7] J. Yuan and S. Yu. Efficient public integrity checking for cloud data sharing with multi-
user modification. In IEEE INFOCOM 2014-IEEE Conference on Computer
Communications (pp. 2121-2129). IEEE. 2014, April.
[8] H. Wang, D. He and S. Tang. Identity-based proxy-oriented data uploading and remote
data integrity checking in public cloud. IEEE Transactions on Information Forensics and
Security, 11(6), pp.1165-1176. 2016.
[9] S. Aldossary and W. Allen. Data security, privacy, availability and integrity in cloud
computing: issues and current solutions. International Journal of Advanced Computer
Science and Applications, 7(4), pp.485-498. 2016.
[10] S. Tan, Y. Jia and W.H. Han. Research and development of provable data integrity in
cloud storage. Chinese Journal of Computers, 38(1), pp.164-177. 2015.

9
IT RISK MANAGEMENT
[11] Y. Zhang, C. Xu, X. Liang, H. Li, Y. Mu and X. Zhang. Efficient public verification of
data integrity for cloud storage systems from indistinguishability obfuscation. IEEE
Transactions on Information Forensics and Security, 12(3), pp.676-688. 2016.
[12] J. Zhang, F. Ren, S. Gao, H. Yang and C. Lin. Dynamic routing for data integrity and
delay differentiated services in wireless sensor networks. IEEE transactions on mobile
computing, 14(2), pp.328-343. 2014.
[13] I. Zikratov, A. Kuzmin, V. Akimenko, V. Niculichev and L. Yalansky. Ensuring data
integrity using blockchain technology. In 2017 20th Conference of Open Innovations
Association (FRUCT) (pp. 534-539). IEEE. 2017, April.
[14] M.F. Al-Jaberi and A. Zainal. Data integrity and privacy model in cloud computing.
In 2014 International Symposium on Biometrics and Security Technologies (ISBAST) (pp.
280-284). IEEE. 2014, August.
[15] G. Gordon, J. Lin, R. Cave and R. Dandrea. The question of data integrity in article-level
metrics. PLoS biology, 13(8), p.e1002161. 2015.
[16] I. Jovanov and M. Pajic. Sporadic data integrity for secure state estimation. In 2017
IEEE 56th Annual Conference on Decision and Control (CDC) (pp. 163-169). IEEE. 2017,
December.