Security Management and Governance Report for Power AI, BIT361

This report provides a comprehensive security management plan and governance framework for Power AI, a company specializing in AI-driven software development for various sectors. The report begins with an executive summary, outlining the company's need for a robust security program to protect its intellectual property and critical assets. It then delves into the introduction and discussion, highlighting the potential risks associated with Power AI's business processes, including data vulnerability and the importance of securing algorithms and source codes. The report emphasizes the benefits of implementing an Information Security Management System (ISMS) and the need for a security management plan and policy. It details the roles and functions within the security management program, including the responsibilities of various personnel such as the IT manager, finance manager, and employees. The report also describes a top-down security model and discusses the implications of legal and statutory requirements. A key component is the preliminary risk assessment and management plan, which identifies potential threats and proposes mitigation strategies. The report concludes by emphasizing the importance of continuous monitoring and maintenance to ensure the ongoing security of Power AI's sensitive data and information. The report also includes an appendix with a risk management plan and a bibliography.

Running head: SECURITY MANAGEMENT AND GOVERNANCE
Security Management and Governance
Name of the Student
Name of the University
Author Note

1SECURITY MANAGEMENT AND GOVERNANCE
Executive Summary
This report discusses the security management and governance program of Power AI, a
privately owned company which develops software for business, industrial and home use.
The company develops AI algorithms for client service. The company faces potential risks in
its business process and hence decided to implement a security management plan. The
security management plan and policy is designed to help the company secure its critical
resources. The risk management report identifies the potential risks the company faces and
provides method to mitigate the identified risk.

2SECURITY MANAGEMENT AND GOVERNANCE
Table of Contents
Part A.........................................................................................................................................3
Introduction............................................................................................................................3
Discussion..............................................................................................................................3
Benefits derived from Security Management and importance of policy implementation.....4
Security management plan and policy...................................................................................6
Roles and functions for the Security Management program..................................................7
Model.....................................................................................................................................8
Implication of legal and statutory requirements.....................................................................9
Conclusion..............................................................................................................................9
Part B: Appendix......................................................................................................................10
Risk Management Plan:.......................................................................................................10
Bibliography.............................................................................................................................12

3SECURITY MANAGEMENT AND GOVERNANCE
Part A
Introduction
This report discusses about the security management plans in Power AI. PAI or Power
AI is a private organization which develops industrial, home and business software. PAI has
two prime organizational units which are directly related to development, sales and support.
The organization has other two vital wings in their business structure, they are accounts and
finance, human resources and information technology or IT services. The organization
chiefly focuses on the development of AI or artificial intelligence systems in their
organizations to optimize and control power generation, use and storage in any challenging
environment. The organization has come with numerous valuable solutions for the mentioned
application. The organization has fifty employees out of them twenty five are in the designing
and development team of the organization. The twenty five employees are directly involved
in the testing and implementation of the products. The design developed by them requires
confidentiality and protection. To protect the valuable blueprint of the AI model, the
company has designed, it is essential to implement an ICT Security Program for Power AI or
PAI. The source codes and associated documents of the company are the critical assets of the
company which requires security. The employees working in the company hold valuable
information of the source codes as it is needed for them to perform their designated work.
The plan charted for the implementing security protocols holds data for better development of
the security program and improvisation on the existing model.
Discussion
PAI organization as known develops software that caters to industries, businesses and
home uses. The company has a high turnover as the employees of the organization hold

4SECURITY MANAGEMENT AND GOVERNANCE
considerable knowledge about artificial intelligence and are of high demand in the IT market
space. The products designed by PAI for the various sectors differ in their production
process. The products for the industrial sector are custom designed for every single
installation. The business products developed are made configurable to utilize available data
properly. Business products needs configuration as they cater to a large spectrum of services
whereas home use products are much less configurable. The company faces concern in
relation to its intellectual property. The algorithms developed by the company are of valuable
investment. The working done by organization is on a closed on-site platform and the control
lies internally. The completed products which are in executable forms are ported into the
cloud. The algorithm developed by the organization holds an estimated value in millions and
any leak of these algorithms will cost the organization heavily in the competitive market.
Benefits derived from Security Management and importance of policy
implementation
Securing sensitive and confidential algorithm and source codes of Power AI is
extremely vital to prevent any leakage or loss. As Power AI generates complex solution
codes for the industrial and business sector, the company runs a high risk of data vulnerability
and a slight leak of the source codes can cost the organization in millions. An Information
Security Management System (ISMS) is a systematic approach for establishing,
implementing, operating, monitoring, reviewing, maintaining and improving an
organization's information security. Information governance is the super set of information
technology. Governing the flow of information and data in an organization is of significant
concern as this can prevent data theft or leakage within the system. Key elements of the
operation of ISMS are ISMS processes. Implementation of a security management program
will provide a systematic approach to manage the confidential source codes of the software so

5SECURITY MANAGEMENT AND GOVERNANCE
that the codes remain secure. The security management system encompasses IT systems,
processes and people. The security management program developed for PAI will ensure the
organization to meticulously handle risks present in the business model by the
implementation of customized security controls and protocols which are in sync with the
need of PAI’s security concern. The major benefit of the security management program is
that it will ensure high employee productivity of Power AI or PAI and tight protection of the
company’s assets. The chief asset of Power AI is their source code developed for AI
business or industrial processes. The security of the data uploaded on the cloud is of another
critical consideration. Information security management system will pro actively minimize
the existing threats and risk for Power AI or PAI. The management program will further
ensure the limitation future security breaches for the organization. The security management
policy will address the numerous processes involved in the production, employee behavior
and also technology and data. The security management program for PAI will target to
protect its critical assets that are the customized algorithms developed by the organization to
cater the clients in several industries. The policy will be implemented in the system of the
organization that will take a distinctive part in the organization’s culture. The security policy
will provide a guideline for the organization to follow and implement security standards to
protect itself from inside out. The implementation of security management in the organization
will encompass the employees and the business processes of the organization. The plan and
policy will further co ordinate the security efforts consistently, coherently and by minimizing
cost. The systematic approach of the plan will enable the easy identification of risks,
utilization of effective methods to manage and mitigate the identified risks and provides the
capability to form an informed decision. Ensures corporate and information governance of
the organization. The benefit of the security management program lies in keeping the security
system of the organization updated and maintained periodically which in turn will result in

6SECURITY MANAGEMENT AND GOVERNANCE
complete security of the sensitive data and information of the organization. Over all, security
management provides a competitive advantage over the other prominent competitors in the
similar domain.
Security management plan and policy
The process of planning out a security management plan and policy for the
organization requires initial investigation into the processes and functioning of the
organization. To develop a stringent and valuable plan, understanding the organization’s
objectives and crucial assets are of prime important. The security plan and policy will revolve
around the identified crucial assets of the organization. The critical asset of the organization
includes the valuable artificial intelligence algorithm the organization develops for various
business and industries. The development of a security plan for the company would require to
critically analyzing the business process of the company and the management hierarchy of
the company. The individual role of the employees plays a vital role in identifying the
potential risks of the organization. The plan also includes an inclusive analysis of the data
storage system of the company and the cloud service the company utilizes to port the
completed products in an executable form. Porting the completed products on the cloud opens
up relatable vulnerabilities for the product. Failure in the cloud model security system will
prove to be catastrophe for the company. The Loss or illegal copies of the source code and
associated documentation would be a significant blow to PAI. A major concern is the
possibility that concept and design information is either lost or provided to competitors. The
security policy will prevent the loss of critical information form the company. Proper cloud
security is essential to protect the information put up in the cloud. The employees of the
company hold valuable information about the source codes and final product as it is
important for their work. Policy of disclosure should bar the employees from disclosing any

7SECURITY MANAGEMENT AND GOVERNANCE
valuable and critical information of the organization without the permission of the head of the
organization as the estimated cost of the knowledge held by the employees is in millions.
Loss in information will surely make the company lose its competitive ground. Security
policies will be developed to secure such issues and provide measures to prevent any arising
risk in the future. The motive of the security plan and policy is to secure source codes and
associated documentation of the company.
Roles and functions for the Security Management program
The security management program will involve a joint effort and collaboration of
roles and responsibilities to function diligently. Power AI or PAI houses a total of 50
employees and out of the fifty employees, twenty five of the employees are directly
associated with the design, development, testing and implementation of the products. The
company has two chief units which are directly related to the products and they are sales,
support and development. The other significant units of Power AI’s business framework
involve human resource, finance and accounting, and IT services. The management hierarchy
of the company comprises three employees chiefly an IT manager, finance and sales manager
plus the owner of the business. The human resource department is run and overseen by the
business owner. The company is known to port the completed executable products to the
service cloud. The company before porting the executable work on the cloud must perform a
preliminary security check on its side to understand the security of the environment. The
company should limit the access count to the cloud to reduce probable risk. The cloud should
be accessed diligently and made sure no ports are opened on the cloud network which can
lead to data leakage. The cloud access credentials must be shared with a specific number of
people and permission should be generated when the cloud is handled. The source codes
when completed can be segregated and ported in different segments as this can prevent the

8SECURITY MANAGEMENT AND GOVERNANCE
complete loss of the code and the leaked part can be readily recovered. The souce codes and
other authenticated confidential documents need secure storage environment to prevent
unauthorized access of the information. The company should hire a senior IT security officer
who will monitor the security IT process of the company and strictly concentrate on the IT
security issues. The company can either hire or promote one of their IT employees to a senior
management position who will monitor and manage the IT processes. The IT manager needs
to strategize security plans to sync with the organizations objectives. The employees of the
company play a significant role in maintaining the confidentiality of the data and information.
The employees need to be diligent and cautious in their working. The IT manager should run
a periodic server and system back door check to monitor the health of the server. The process
will aid the manager to identify any glitches in the system or soft spot in the network channel
which can lead to security issues in the future. The finance manager should carve out
significant budget to invest and maintain the IT security services of the company. The
manager should invest in periodic survey, monitoring and analysis of the network model and
business structure of the company. The mentioned measures will help strengthen the
company’s security system.
Model
The security model to be considered for Power AI or PAI is a top-down direction
model. In the top-down direction model, the management of the organization deals with the
decisions of the organization and accepts the changes in the model to act in accordance with
the situation. The management of the company will decide and defines the information
polices and security polices of the company in all sections of the company including the
management levels will carry out the policies as in the norm. The management will assign

9SECURITY MANAGEMENT AND GOVERNANCE
resources for work related to information security. The overall security (operational security,
information security and personal security) of the company will be guaranteed.
Implication of legal and statutory requirements
The successful implementation and execution of the security plans and policy for
Power AI will require the legalization of the scheme. The legal implications will strengthen
the security policy of the company. Hence if any breaches occur in the security policy the
company can take legal steps to save itself form security issues and prevent any future
security troubles for the organization. Legalizing the policy will frame the business module of
the company in a more compact manner.
Conclusion
Thus the report provided an overview of the needed security protocols and policy to
be implemented in the business model of the company. The security plans and protocols will
strengthen the business processes and functionalities of the organization and will surely
enhance productivity of the company.

10SECURITY MANAGEMENT AND GOVERNANCE
Part B: Appendix
Risk Management Plan
Risks are generally considered to be an uncertain event or a condition which when occurs is
associated with having a positive or a negative impact upon the objectives of an organization.
A risk management plan is the plan, which consists of an analysis of the risks which are
likely to occur and are having high as well as low impact.
Steps for building the Risks management Plan:
 Identification of the risk
 Analyzing the identified risk
 Risk evaluation
 Response planning
 Monitoring and reviewing the risk
Benefits of Risks Management Plan:
 Identifying the underlying risks which are not apparent helps to foster vigilance and
calmness during crisis.
 Focus is on the identified tasks on assisting the impact of projects and business. The
process provides added solutions.
 Aids in treating the risks that are the subsets of implementing a plan.
 Data process and policies are improvised to reduce the risks within the structural
behavior.

11SECURITY MANAGEMENT AND GOVERNANCE
Contingency Plan:
 Identification of the risk
 Quantification of the risk
 Response to the risk
 Control and Monitoring
Risk Register
Identified risk Cause of risk Impact of the
risk
Likelihood of
occurrence
(low high or
medium)
Schedule risk Incorrect
estimation of
time of
delivery
Company’s
economy is
affected
leading to
project failure.
Low
Confidentiality
of the source
codes
The
employees
working on
the project has
the
information
about the
Leakage of the
source code
will jeopardize
the company’s
position in the
market and the
competitors
Moderate