Security Management Program Report for East Marine Supplies (EMS)

This report addresses the need for a robust security management program for East Marine Supplies (EMS), a company dealing with marine equipment and installations. The report begins with an executive summary highlighting the importance of maritime security and the role of a security management system in protecting sensitive data and organizational functions. It then details the purpose of such a program, emphasizing data protection, preventing unauthorized access, minimizing risks, and aiding management decision-making. The report outlines the development of security policies and management programs, including key considerations like access rights and data digitalization. It proposes a five-step approach to program development, covering business awareness, program definition, development, metrics and benchmarking, and implementation. The Access Control Model is identified as relevant, with principles like least privilege and separation of duties discussed. The report also details the functions, tasks, roles, and responsibilities of a security management program, emphasizing data protection, risk mitigation, and ensuring secure access to information. The report is designed to provide a comprehensive understanding of how EMS can enhance its security posture.

Running Head: Security Management Program
Security Management and Governance
Report
AUGUST 30, 2019

Security Management Program 1
Executive Summary
The maritime security is one of the crucial and essential need for merchant’s vessels because of
piracy and security threats. The security management system helps the company to keep their
transaction and operations safe from hackers and other element who can leak the privacy of the
company. Security management program helps the company to manage the information flow in
the company and secure the confidential data and information of the company from outsiders. It
also helps the company to manage their transactions and organizational functions under a
security management, which is unbreakable for any people who want to unethically access the
data or information of the company.
The purpose of this report to provide a detailed overview about the need and requirements of
security management system to the ‘East Marine Supplies’ (EMS). This report explains the
importance of security management program that how it can help provide a better information
security to the company. This report also helps the CEO to know about the development of
security management program.

Security Management Program 2
Table of Contents
Executive Summary.........................................................................................................................1
Introduction......................................................................................................................................3
Purpose of a Security Management Program..................................................................................3
Development of Security Policy and Security Management Program............................................4
Development of Security management program.........................................................................4
Models that is relevant to development of a security management program..................................5
Outline of Security Management Program......................................................................................5
The Legal and Statutory Requirements...........................................................................................6
Conclusion.......................................................................................................................................6
References........................................................................................................................................7

Security Management Program 3
Introduction
This report is based on the developing a security management program which is necessary for a
company to secure and protect the crucial and confidential information from any un-authentic
person or entity. The security management program is a need of almost every high-tech
organization to save and protect their information (Barton, Tejay, Lane, and Terrell, 2016). The
purpose of this report to provide a detailed overview about the need and requirements of security
management system to the ‘East Marine Supplies’ (EMS). In this report, the purpose and
advantage of security management program has been discussed. The report also describes the
model that can help to develop a security management program for the EMS by considering the
legal and statutory requirements.
Purpose of a Security Management Program
The security management program is an essential need for those companies that involves in
sensitive data and information transactions. Security management program is a set of policies
and computer programs that helps the organization to systematically manage the organizational
data and information from the unauthentic source or from outsiders of the company
(Almuhammadi and Alsaleh, 2017). The main purpose of security management program in the
organization are as follow:
1. Protecting the credential information and data from theft or damage: The security
management program protects the confidential data from damage or theft. It can also help
the organization to recover the lost data and bring the information in its original form
again (Sennewald and Baillie, 2015).
2. Preventing unauthorized access of data or crucial information: The security
management program also helps the organization to prevent those unauthorized access
that want to damage or destroy the important and secret information (Laudon and
Laudon, 2016). Even the security management system prevents the employees to access
the information if they do not have their credential or right of accessing data of the EMS.
3. Minimize the risk: The security management program minimizes the risk of data loss or
fear of recovery of data which was damaged earlier. It provides 24-hour security to the
company and its crucial data. The security management program always has a backup
plan for the information and data which is store in the system (Rajpoot, Jensen, and

Security Management Program 4
Krishnan, 2015). It also helps the company to manage their transactions and
organizational functions under a security management, which is unbreakable for any
people who want to unethically access the data or information of the company.
4. Detect unidentified risks and addresses properly: The security management program
always thinks one step ahead. The security management program helps the organization
to identify the risk in advance and destroy the risk from the root to access the data. In
such a manner, it protects the crucial information of the company. Apart from this, it also
helps the authentic person of the organization to easily access the data and information
about the company and make decisions based on access data and information (Safa, et.
al., 2015).
5. Provide support to top management in taking decision by identifying risks and
provide risk treatment options: The security management program also helps the
management and top officers of the organization to make decision on the basis of
identified risks and available treatment for that risk which is provided by the security
management program. In other worlds, it also helps the organizational leaders to make
relevant and appropriate decision in the organization by considering the possible threats
and security concerns.
Development of Security Policy and Security Management Program
To develop security policy the organization needs to consider following points:
1. Never allowed any person to access the information without any authentic rights.
2. Any third party cannot access the information without permission of regulatory bodies.
3. Employee should have proper objective and purpose to access a particular information.
4. The employee should not allow any clients to unlawfully entered in the manufacturing
complex.
5. Every people have clear defined role and responsibilities and no people allowed to access
the information which is irrelevant or unusual for them. Each data is specified to access
particular and authentic person of the organization.

Security Management Program 5
6. Every information should be accessible for the centralize database system for the storage
and security purpose. Every information needed to be digitalized in the organization
which needed to be future access by the people.
Development of Security management program
To develop the security management program, it is essential to understand the nature of business.
In the above case EMS is dealing with marine vessels and its installation. However, the company
also deals in online buying and selling of equipment, so it needs a multiphase and comprehensive
security management program. Here are the five steps that will help to build an effective and
protective security management program for the organization:
1. Business Awareness: The first step in the development of security management
program, it is essential to know the nature of business and its functional areas. Apart from
this, the budget consideration, number of staffs, and complexity in business process sis
crucial to before starting the development program. One of the major parts in this stage is
identification of risks and its type which is involve in the function of EMS. Detailed
description of each risk is required before developing the security management system
(Wickboldt, et. al., 2015).
2. Program Definition: It is required to set the goals and objectives of security
management program on periodic basis such as annually, two yearly, three yearly or five
yearly. The objective must be met on an annual basis. The plan should be flexible to
accommodate the business conditions and activities (Chen, Ramamurthy, and Wen,
2015). Apart from this, it is necessary to determine the point of arrival of system in the
organization. It is also crucial to analyses the capabilities and availability of every
employees in the organization during execution of the program. It is considerable that it
may be possible that employees of the organization are not well qualified about the
security system program, so they need training and education program for adopting the
new security changes in the organization (Knowles, 2015).
3. Program Development: The third step is development of program. In this stage, the
programmer or engineer needs to define the functional capabilities and controls related to
security system. This stage includes vulnerability assessment, incident response, training
and communication etc. If the organization want to outsource the security system from

Security Management Program 6
the third party, the organization needs to consider the risk and must ensure that every
activity will perform under oversight of internal staff (Layton, 2016).
4. Metric and Benchmarking: At this stage, the organization needs to set a benchmark for
the system that measures the effectiveness of the security management system. For this
purpose, the it is necessary to align the organizational or industry standards and
guidelines with the system (Peltier, 2016). There are multiple of standards that can help
to measure the performance of system such as ISO 27000 series and US National Institute
of Standards Technology (NIST) 800 series. Apart from this, organization can also set the
KPIs to measure the capabilities and performance of the security management program.
In this type of performance measurement, organization set the define objective or value
that it wants to achieve and then measure the performance of system with that standards
(Knowles, et. al., 2015).
5. Implementation and Operation: This is the final stage where security management
system is ready to identify threats, protect the organization from that threat, respond the
risk or type of threats, and recover the data. However, it is the responsibility of
employees and staff of the organization to review the program on periodic basis and bring
changes when needed to avoid any future security threats like hacking of system, theft of
information, or protect the organization from cyber-attack.
Models that is relevant to development of a security management program
EMS is large organization, so it needs both logical access and physical access of information
system. Even the EMS deals with collection of policies and strategies related to its business. To
see the requirement of the organization ‘Access Control Model’ of security management. This
model carries out those policies and programs which are essential for the organization (Behera
and Khilar, 2017). This model has several key principles that can help to provide security to the
information:
1. Least Privilege: Employees can access the least amount of data for minimum time to
perform their required duties.
2. Need Know: System only allow to those people who are already registered in the
program. Access of information required specific information or credential of employee
and people are allowed to perform currently assigned task only.

Security Management Program 7
3. Separation of Duties: Completion of one task required more than one people to
accomplish the task.
The duties of such type security model is to prevent any threat or risk (means avoid incidents),
deterrent (prevent any initial issue or incident), detection (detect the identified or existing risk or
threats), corrective (mitigate the damage done by any threat or factors), recovery (back up the
data and restore it in the system again), and last compensating (resolve any shortcomings)
(Soomro, Shah, and Ahmed, 2016). The type of security model can be used on every operational
level such as management level, operational level, and technical level.
Outline of Security Management Program
The security management program is responsible for following outcomes:
Functions: The security management program protect the data from outsiders and avoid,
mitigate, and protect the information system of organization from any external threats or risk. It
also stores, backup, and recover the data and information of the company. The program avoids
the unauthentic access to the information and ensure that only authentic person can access the
data and only for limited time of period to complete their duties or assigned task (Chen,
Ramamurthy, and Wen, 2015).
Tasks: The type of security management program can be used on every operational level such as
management level, operational level, and technical level. The fundamental task of this model is
to avoid and prevent risks, prevent any initial issue or incident, detection of existing risk or
threats, mitigate the damage done by any threat, restore of data in the system and last
compensating means resolve any shortcomings (Dhillon, Syed, and Pedron, 2016).
Roles and Responsibility: The key roles and responsibilities of security, management system is
to protect the crucial and confidential information of EMS and ensure authentic and safe access
of information in the organization and protect the privacy of the company.
The Legal and Statutory Requirements
The statutory and legal requirements are the requirements that security program must be
compliance with the legal and contractual requirements. The EMS must install only those system
that are qualifying the ISO 27000 series requirements and get the certification. Apart from this,

Security Management Program 8
the EMS can also adopt those system which are certified by the NIST 800 series. These series
ensure that the security system follow the basic legal and statutory requirements and do not
breaches the law related to contractual requirements, Intellectual property rights (IPR), are
capable in protection of records, and are capable in protecting the personal identifiable
information of the organizational people. If these all requirements are fulfilled by the security
system, it will get the certification of ISO 27000 serios or NIST 800 series certification for
quality and legal compliance (Stewart and Jürjens, 2017).
Conclusion
In conclusion, EMS must use the security management system in the organization to protect its
confidential data from external or unauthentic sources or threats. The organization can install the
security management program which is based on the ‘Access Control Model’ and is certified by
the ISO 27000 series or NIST 800 series. This will help the company in better management of
data and information and protect the privacy of the company to operate its business in safe and
secure business environment. The company can outsource the system from the third party, but it
is really necessary for the company to ensure that the installation of security system should be
done under the oversight of an internal organizational staff member or group of members.

Security Management Program 9
References
Almuhammadi, S. and Alsaleh, M. (2017) Information Security Maturity Model for Nist Cyber
Security Framework. Computer Science & Information Technology, 51.
Barton, K.A., Tejay, G., Lane, M. and Terrell, S. (2016) Information system security
commitment: A study of external influences on senior management. Computers & Security, 59,
pp.9-25.
Behera, P.K. and Khilar, P.M. (2017) A novel trust-based access control model for cloud
environment. Proceedings of the International Conference on Signal, Networks, Computing, and
Systems, 9(7) 285-295.
Chen, Y.A.N., Ramamurthy, K.R.A.M. and Wen, K.W. (2015) Impacts of comprehensive
information security programs on information security culture. Journal of Computer Information
Systems, 55(3), pp.11-19.
Dhillon, G., Syed, R. and Pedron, C. (2016) Interpreting information security culture: An
organizational transformation case study. Computers & Security, 56, pp.63-69.
Knowles, W., Prince, D., Hutchison, D., Disso, J.F.P. and Jones, K. (2015) A survey of cyber
security management in industrial control systems. International journal of critical
infrastructure protection, 9, pp.52-80.
Laudon, K.C. and Laudon, J.P. (2016) Management information system. New Delhi, India:
Pearson Education India.
Layton, T.P. (2016) Information Security: Design, implementation, measurement, and
compliance. UK: Auerbach Publications.
Peltier, T.R. (2016) Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. USA: Auerbach Publications.
Rajpoot, Q.M., Jensen, C.D. and Krishnan, R. (2015) September. Attributes enhanced role-based
access control model. In International Conference on Trust and Privacy in Digital Business,
7(5), 3-17.

Security Management Program 10
Safa, N.S., Sookhak, M., Von Solms, R., Furnell, S., Ghani, N.A. and Herawan, T. (2015)
Information security conscious care behaviour formation in organizations. Computers &
Security, 53, pp.65-78.
Sennewald, C.A. and Baillie, C. (2015) Effective security management. UK: Butterworth-
Heinemann.
Soomro, Z.A., Shah, M.H. and Ahmed, J. (2016) Information security management needs more
holistic approach: A literature review. International Journal of Information Management, 36(2),
pp.215-225.
Stewart, H. and Jürjens, J. (2017) Information security management and the human aspect in
organizations. Information & Computer Security, 25(5), pp.494-534.
Wickboldt, J.A., De Jesus, W.P., Isolani, P.H., Both, C.B., Rochol, J. and Granville, L.Z. (2015)
Software-defined networking: management requirements and challenges. IEEE Communications
Magazine, 53(1), pp.278-285.