1 COMPUTER GAMING TECHNOLOGY INC., A Software-4-All Com

1
COMPUTER GAMING TECHNOLOGY INC., A Software-4-All
Company
ABOUT COMPUTER GAMING TECHNOLOGIES INC.
CGT Inc. is a premier developer of games and entertainment
software. Thanks to an experienced staff and
creative environment CGT has developed an impressive string
of successful titles. By combining cutting edge
technology, enchanting graphics, and superior game design,
CGT has become a leading force in the world of
interactive entertainment software.
CGT Inc. develops and publishes each for PC and all popular
video games system platforms. The company
employs a diverse staff of people whose talents range from
computer programming and game design, to
writing screenplays and composing sound tracks.
History
In 1992, Alan Hake set to work in a garage in Las Vegas. From
those humble beginnings came CGT Inc., one of
the most successful entertainment software companies in the
history of the industry. Among its early
creations are Space Saga (1992), Robo-Wars (1994), and Quest
for the Staffs (1997), which garnered the young
company its first taste of widespread recognition at home and

abroad.
In 2000, the company was acquired by Software-4-All, which
enabled CGT Inc. to partner directly with a
software publisher and enjoy Software-4-All’s superior
worldwide distribution network. It was also the year
CGT released two now legendary titles in the gaming word:
Fanastica (2000), followed shortly by the game
that defined the real-time strategy genre, Destiny (2001). Soon
after came Seek & Destroy (2003) and Seek &
Destroy: Apocalypse (2005), which set sales records all over the
world and redefined the real-time strategy
genre.
In 2007, the company relocated to Atlanta, Ga, in order to take
advantage of the increased pool of talent in
the game design and programming fields. CGT relocated the
programming facilities to a remote area north of
Atlanta, to provide a higher quality of life for CGT’s employees
yet retain access to Atlanta’s large employee
base and transportation network.
CGT set new standards in 2010 with the release of Hacker
(2010), which combined groundbreaking graphic
technologies with a depth of storytelling rarely seen in
computer games. The next year, the Seek & Destroy
series topped the 10-million-unit sales mark, a rare achievement
in the interactive entertainment industry.
Many successful titles followed, including additional titles in
their award-winning series: Seek & Destroy:
Suicide Squad (2012) and Destiny II: Afterlife (2014). Several
other successes have followed since then.
Today, CGT Inc. is already exploring new technologies like
Virtual Reality and developing games that will set
trends well into the future.

Organization
CGT is headed by CEO Alan Hake, who is supported by his
three executives: Chief Operations Officer Richard
Xavier, Chief Business Officer Rachel Xieng, and Chief
Information Officer, Paul Alexander.
2
Corporate Org Chart
CGT, Inc. is currently organized into the following divisi ons to
support past, present and future software
offerings.
GAMING DEVELOPMENT DIVISION
The gaming development division is headed by the Chief
Operations Officer and is comprised of the following
departments:
Development
Development handles new software development. A series of
teams each address the various aspects of the
different game packages under development. These
programmers use their specialized graphical design
workstation to integrate video, computer-generated graphics,

and multimedia formats to create the high
impact games most popular in today’s market. All data is stored
on the servers and, except for scheduled
backups, it cannot be removed until released for testing or to
production.
Testing
Testing handles in-house testing of new games. Once the
Development department creates and delivers a
coded product, the Testing Specialists assist in identifying and
diagnosing system critical code defects. Once a
“kill list” is compiled, the Development teams work through the
bugs to create an improved program. This
division is also responsible for the identification and
administration of external product testers. These
individuals are identified from the local area and brought into a
specially prepared test lab, where they are
encouraged to “stress test” the packages. The Testing
department works with the Development department
to collect and catalog additional deficiencies in the coding.
Client Support
Client Support handles technical support problems from the end
clients (the gamers) for published games.
They use standardized helpdesk and diagnostic software to
identify and provide resolution on problems
resulting from the installation and use of a CGT product. Client
support handles the bulk of their support
through their online web server which contains user forums and
direct customer support chat sessions. Client
support also provides email-based support, but not phone-based
support.

3
Gaming Development Division Org Chart
BUSINESS SERVICES DIVISION
The Business Services Division (BSD) is headed by the Chief
Business Officer. Most of the administrative
support falls under this division. BSD is organized into the
following departments:
Accounting
The Accounting department provides traditional accounti ng
functions (accounts payable, receivable,
procurement and general ledger).
Human Resources
The HR department provides traditional human resources
functions (time management, payroll,
health/liability insurance management and retirement benefits)
as well as supports hiring and termination
activities.
Marketing
There is a small Marketing department that coordinates with the
downstream software publishers for
marketing purposes. The department also handles public
relations functions.

4
Business Services Division Org Chart
IT DIVISION
The IT Division manages all internal IT functions. CGT has a
very mature IT department with a centralized data
center. In the data center, all applications run on a dedicated
server, with all applications and their internal
data backed up daily to their rack’s Network Attached Storage
(NAS) unit. No data is stored locally on user
systems, only on corporate servers.
There are three departments within the IT Division:
Systems Operations Group
The Systems Operations Group (SysOps) is responsible for the
installation, maintenance and change of all
hardware, software, and computing equipment used internally
by CGT. SysOps maintains a standing inventory
of systems and peripheral components to facilitate operations
and maintains a 24-hour helpdesk for internal
support. Employees can call, email, or just stop by with a
problem, and a support representative is be available
to answer questions, resolve problems, or replace defective
systems.

Network Operations Group
The Networking Operations Group (NetOps) is responsible for
all networking functions, including
internetworking company networks to the Internet through the
ISP. NetOps is also responsible for the
administration of all perimeter defense equipment (firewalls,
VPNs, and DMZs).
Server Operations Group
The Server Operations Group (ServOps) is responsible for the
management and support for all corporate
servers, including Active Directory, DNS, Email, Web, Backup
(NAS), and servers for all internal support
functions.
5
IT Division Org Chart
CGTs IT infrastructure
While there currently is no formal cybersecurity department or
structure at CGT, the IT department manages
its security systems for the data center, internal networks, and
applications. All corporate applications have a
secure intranet interface that employees use to connect to the
systems from their office desktop systems. No
data is stored on users’ systems. All server-based applications

have internal databases. The Corporate offices
connect to the Internet through a Palo Alto Firewall. In the data
center, all applications have their own
dedicated servers, with all applications backed up daily to their
server rack’s Network Attached Storage (NAS).
Each NAS backs its data up to another NAS daily as a single
encrypted file once application backups have
completed. A NAS also backs up its own backup software to an
internal drive. All NAS data is encrypted and
backed up weekly to an off-site backup service – Redundant
Redundancies, Ltd. (known as Software-as-a-
Service). No development clients or servers are connected to the
Internet. In the data center, only a NAS can
upload to the Internet to store its encrypted backups with the
backup provider via a VPN connection.
All employees access their networked applications over
desktops through physical wired LAN connections
within the branch offices (no laptops, tablets or mobile devices
can connect to the corporate network), which
uses a secure VPN connection for all traffic between the data
center and the client systems. CGT does not use
Wi-Fi networking in any of its offices. The current informal
policy is no BYOD on premises. All employees must
keep their cell phones in their vehicles, personal locker s,
briefcases, or purses and only use them during
authorized breaks.
6
The CGT Secured Server Data Center contains the following:

Rack 1: Servers containing internal Corporate IT Applications:
Server A. HRIS - Human Resources Information System from
CGT which handles hiring, employee records,
annual reviews, benefits, and other HR functions.
Server B. PAYROLL – Payroll processing system from CGT
which handles time management, wages,
payroll deduction, taxes etc.
Server C. Account-Master – Accounting software which handles
accounts payable, accounts receivable,
procurement and general ledger functions.
Server D. Regu-Nation – Specialized software used to track and
document critical legal and regulatory
requirements and mandates across the software industry.
Server E. HelpMe – Customer service software used to manage
client technical support.
Server F. Clientz – Customer order management software, also
manages non-technical customer
support, order support etc.
Server G. Sell-IT – Specialized software used to support the
sales and service for company products.
Server H. Market-IT – Specialized software used to support the
development and delivery of marketing
and sales support materials.
Server I. Dell Storage Network Attached Storage (NAS) #1
Backup and Recovery Software (BARS) – Runs
Windows 2016 R2 – multi-terabyte data backup capability for
Rack 1 server applications and

NAS#3 Data.
Rack 2: Servers each containing the “Develop-IT” software used
to support the development platforms, testing
environments, and source code for various CGT products – used
by the software design teams. All
Develop-IT servers act as file shares within their development
group.
Server J. Develop-IT – Legacy (Space Saga, Robo Wars, and
Quest of the Staffs)
Server K. Develop-IT – Fantastica line
Server L. Develop-IT – Destiny line
Server M. Develop-IT – Seek & Destroy line
Server N. Develop-IT – Hacker line
Server O. Develop-IT – New Title Research & Development
Server P. Dell Storage Network Attached Storage (NAS) #2
NAS#1 Data.
Rack 3: Infrastructure servers to support internal web, email
and IT operations.
Server Q. Manage-IT – Specialized software used to monitor,
inventory and report on corporate and data
center IT resources and functions. Includes network monitoring
software.
Server R. Webz – the CGT web site (not an ecommerce server),
runs on Windows 2016 IIS Server
Server S. Support-IT – used by IT department to manage
systems configuration, updates, and internal
helpdesk tickets.
Server T. Active Directory Service – manages users, their login

and account privileges, drive storage and
other administrative network functions.
Server U. Domain Name Service – used to route internal web
content to intranet servers and to/from
external web sites.
7
Server V. MailCall – IMAP/Web-based Email system. All email
retained on server; no independent mail
clients allowed.
Server W. Office FileShare – location for all employee files,
including the records created and stored
through the Online Microsoft Office 365 application.
Server X. Dell Storage Network Attached Storage (NAS) #3
NAS#2 Data.
All NAS data is backed up weekly to a Cloud-based backup
service (Software-as-a-Service) as a single
encrypted file.
Summary (used in the project tables):
All Applications have internal data and are stored on Servers
and accessed by Internal Users from their
Desktops over the Internal Network-Wired. Some of the assets

aren’t applications (NAS data and Office
FileShare). Some assets are considered File-Shares (The
Develop-IT applications and the Office FileShare). All
applications are backed up their rack’s NAS (External Storage)
daily. Each NAS backs its data up to another
NAS. Each NAS backs up its data to the Cloud Backup Service
Provider (Software-as-a-Service) weekly as a
single encrypted file.
Security
There currently is no formal cybersecurity department or
structure at CGT. Physical security is outsourced to
Ironclad Security, Inc., of Atlanta. All employees are issued a
photo ID keycard used to enter the facility and
property. All visitors to the facility must be coordinated through
the corporate office, and escorted on the
premises at all times. A closed-circuit video monitoring system
records all major hallways and entrances to the
building. The video feed is routed to the central physical
security office, which is manned 24/7.
There are currently no formal cybersecurity policies, standards
or guidelines identified or implemented.
ISSP Policy Recommendations for {Case Organization}Ima
Student
ISSP Policy on {Issue} for {Case Organization} , {Your
Name}
ISSP on {Issue} for {Case Organization}
In this section the student should write a complete ISSP on the
topic provided, using the outline below, as described in the text

to serve as an example the organization can follow in writing
the other ISSPs (typically 4-6 pages).
<Case organization> refers to the company described in the case
organization document.
<issues> refers to the assigned subject of this ISSP (e.g. fair
and responsible use of company computers/networks).
DO NOT SIMPLY USE THE PROVIDED TEXT – some generic
examples are provided. It’s up to you to use these to write your
own policy paragraphs, adapting the provided example as
necessary. In many cases additional discussion or description is
needed.
There should be no need for quotations (which are prohibited),
or in-text citations from paraphrasing. If you generally
summarize outside material, it should be included as a
reference, but the body of the policy should be 100% your own
writing – other than the outline provided in bold.1. Statement of
Purpose
Don’t put text after a numbered header – put it after the lettered
sub-sections.a. Scope and Applicability
A discussion of the purpose, scope and applicability of the
policy.
“The purpose of this policy is to specify the fair and responsible
use of <topic/technologies> by <case organization> employees,
partners, contractors, associates and their bartenders (etc.)…b.
Definition of Technology Addressed
A definition of any technologies discussed in this policy
document. This is the only section of the document that may
comprise a list.
“As described in this policy, the following term and definitions
are used:
Computer – describes any desktop, laptop, tablet or server
owned by <case organization> and used to support its
operations.
(etc.) …c. Responsibilities
A discussion of the roles and responsibilities of all personnel
defined in 1a. above, including users, management, IT, InfoSec,

and policy administrators. Should address their responsibilities
both in the fair use of <topic/technology> and in the
administration of this policy as applicable. Avoid using
personal names, instead use titles or positions.
“Upper management of <case organization> is responsible for
providing strategic guidance and…
“All users are expected to use the <issues> responsibly and only
on in support of their assigned duties and responsibilities…
Further all authorized users are expected to protect and
safeguard all (data/hardware/software/networking/stuff)
associated with <issues>…”
“The Senior Policy Manager is responsible for the
administration, distribution and enforcement of this policy…”
“The <case organization> office of issuing-user-access-and-
assigning-privileges is responsible for implementing the
technical access controls allowing access to information
specified by each authorized user’s position and
responsibilities, subject to the principles of least privilege and
need-to-know…”
“Each data owner is responsible for determining the information
each user needs to access and the conditions and restrictions of
that access…”
(etc.) …2. Authorized Usesa. User Access
Describes who, what, when, where, why and by whom, of access
and use to the <assigned issues>.
“Access to <assigned issues> will be controlled and
administered by the <case organization> office of controlling-
and-administering of stuff…”
“Users are restricted to use of <issues> during business hours,
on company premises, and only using company-issued stuff …”
(etc.) … b. Fair and Responsible Use
Describes what authorized users of the <assigned issues> CAN
use them for.
“All <case organization> assigned <issues> are to be used by
authorized users as specified in 1.a. above, and exclusively in
support of company operations…”

(etc.) …c. Protection of Privacy
Emphasizes and defines the requirement to protect sensitive
data (including PII) associated with users and data within <case
organization>’s systems. Includes all individuals, organizatio ns
and systems that may have data within the <assigned issues>
“Assigned access to sensitive data (e.g.
customer/employee/HIPAA/product/partner/supplier data) is
restricted to authorized use in support of official <case
organization> operations on a need-to-know/least privilege
basis…”
“<Case organization> will take every reasonable precaution to
protect and administer the protection of all classification data
transmitted/stored or processed by <issues> in accordance with
<case organization> Data Classification and Sensitive Data
Management policies, and all applicable
local/state/federal/international laws/policies/regulations …”
(etc.) …3. Prohibited Usesa. Disruptive Use or Misuse
Describes what authorized users of the <issues> CAN NOT use
them for.
“Any use that is not in direct support of <case organization>
use is considered misuse and thus expressly prohibited. This
includes but is not limited to social media sites, shopping sites,
entertainment sites, etc. except as related to official business…”
“All users are prohibited from personal use of <case
organization> assigned <issues> or use outside business hours
or from outside the organizational properties and systems…”
“All users are further prohibited from the connection of
personal technologies and systems to <case organization>
assigned <issues> or the storage of <case organization> data on
personal technologies and systems, to include but not limited
to…”
“All users are required to maintain currency on security threats
to <issues> in order to avoid accidental disruptive use (e.g.
opening malware infected emails or accessing spoofed web
sites.). Failure to maintain currency through scheduled security
training will result in loss of access…”

(etc.) …b. Criminal Use
Emphasizes that <case organization> will not tolerate criminal
use of its <issues>, and in fact will assist in prosecution should
anyone described in the scope and applicability section use the
<issues> for illegal activities.
“All users of <case organization> <issues> are expressly
prohibited from use of said <issues> in illegal, illicit or
criminal actions or activities…”
“Any attempts to gain unauthorized access to <case
organization> <issues> or escalate privileges will be treated as
criminal use, and prosecuted…
“Should any individual be determined to have violated this
clause, <case organization> will fully support and facilitate any
and all criminal proceedings resulting from such use. Further,
no legal support will be provided to anyone formally accused of
violating any (local/state/federal/international)
(law/policy/regulation) ….”
(etc.) …c. Offensive or Harassing Materials
<Case organization> promotes and supports a work environment
free from harassment or exposure to offensive materials. Any
use of <issue> that results in the creation of a hostile work
environment will be investigated by <case organization> office
of offensive-and-harassing-materials-creating-a-hostile-work-
environment-investigations. Violators will be subject to
disciplinary actions, and possibly legal prosecution…”d.
Copyrighted, Licensed, or Other Intellectual Property
Specifies the expectation to protect copyrights, licenses and IP
of the <case organization> and any materials related to <issues>
currently in the passion of <case organization>.
Section should refer to applicable (laws/regulations/policies).
“In accordance with U.S. Copyright Law, as well as other laws
and regulations of the U.S., and the State of (case
organization’s state), all responsible individuals as defined in
Sections 1.a. and 1.c.are prohibited from the unauthorized
installation, use, duplication, and distribution in violation of
(copyright/intellectual property/trademarks/patents) associated

with <issues> to include, but not limited to…”
“Violators of this policy will be subject to disciplinary action,
and possibly legal prosecution…”
(etc.) …e. Other Restrictions
A discussion of any restrictions not covered in the above.
“Any individual described in Sections 1.a. and 1.c. above of
<issues> may not move said item(s) from its/their assigned
location as determined by the <case organization> official
positioner of stuff…”
“No authorized user may allow another user, authorized or not
to use their access credentials, workstation, or technology
associated with <issues>…
(etc.) … 4. Systems Managementa. Management of Stored
Materials
This section will specify the expectations associated with the
administration of the storage and protection of data or other
information associated with <issues> to include, but not limited
to, both hard and electronic copies of data, whether internal (as
in storage locations in the cloud, networked hard drives, etc.) or
external (as in Flash/USB drives) or print-outs, copies stored in
filing systems, desks, briefcases, etc. Includes the
who/what/when/where and why of storage, including data
classification and retention regulation.
“No data associated with <case organization> <issues> may be
printed, downloaded, filed, stored, or transported to offsite
locations, except as part of authorized and monitored data
backups performed by the <case organization> official backer-
upper-of-stuff…”
“All on-site data must be stored in the assigned network
drive…”
“All hard copy (reports/printouts) must be secured at all times
in accordance with the <case organization> Clean Desk and
policy…”
“Refer to the <case organization> Information Retention and
Disposal policy for details on how long data should be retained,
and proper methods of disposal…”

“Refer to the <case organization> policy on information
classification for details on how different classifications of
materials should be labeled and stored…”
“Refer to the <case organization> policy on (other issues) for
details on managing materials associated with that issue…”
(etc.) …b. Employer Monitoring
This section serves to remind and reinforce users of the
organization’s position on employer monitoring – but only of
that associated with <issues>.
“<Case organization> reserves the right to monitor any and all
communications and data transmitted, stored or processed by
<issues> for suspected violations of this policy, criminal
actions, information security breaches, malware and any other
suspicious activity…”.
“Any use of <issues> constitutes consent to such monitoring...”
“All monitoring will be managed by the <case organization>
office of monitoring-stuff-on- <issues>.”
(etc.) …c. Virus Protection
A brief discussion of the expectation of the use of malware
protection associated with (issues) and a prohibition against
tampering/removing said protection.
“All authorized users of <issues> are to ensure that all
reasonable and customary malware protection technologies are
deployed and operational and are expressly prohibited from
adjusting, tampering with, or removing those protections.
Should these protections be missing or non-functional,
immediately contact the <case organization> office of malware-
protection-installation-and-operations for technical support.d.
Physical Security
A brief discussion of the expectation of the requirements for
access and protection of any use of any physical information or
technology associated with <issues>.
“All authorized users of <issues> are to ensure that said items
are only used in protected locations, and upon completion of
use, to return said items to a fully locked and secured state…”
“This includes all inputs, outputs, components, devices,

widgets, gizmos and gadgets associated with <issues> to
include, but not limited to, data stored on any external
disk/drive/tape/hard copy/holographic crystal storage device or
thing…”
“The <case organization> office of locks-keys-and-other-
physical-security-stuff is responsible for the administration and
regulation of physical security. Should anyone identify or
discover <issues> left in an unsecured state, report to this office
immediately…
(etc.) …e. Encryption
A brief discussion of the expectation of the requirements for the
use of encryption when authorized to transmit data associated
with <issues> if such transmissions are authorized to begin
with...
“All authorized <case organization> external-transmitters-of-
data associated with <issues> must ensure that any transmission
of said data must employ <case organization> standard
encryption technologies, based on current DoD Advanced
Encryption Standards…”
“Any use of encryption should be incompliance with the <case
organization> policy on encryption and should ensure all keys
are escrowed with the <case organization> office of external -
data-transmission-encryption. Contact this office for
authorization and training on the use of encryption…”
(etc.) …5. Violations of Policya. Procedures for Reporting
Violations
This section will describe the process for reporting a
suspected violation of this policy…
“Anyone observing a violation of this policy should
immediately report it to the <case organization> office of
policy-violation-and-reporting using the anonymous web form
located at http://www.<case organization>.org/anonymous-
policy-violation-reporting-form.html.”
(etc.) …b. Penalties for Violations
This section will describe the general penalties for violating
this policy.

“Any individual determined to have violated any portion of this
policy will be subject to disciplinary action, up to and including
termination. Any individual determined to have committed a
crime associated with this or any <case organizatio n> resource
or technology will also be referred to local, state or federal law
enforcement for legal proceedings…”
“<Case organization> will provide no legal support for anyone
found to have violated its policies or any law or regulation…”
(etc.) …6. Policy Managementa. Scheduled Review of Policy
Briefly describe the process for revising this policy.
“The <case organization> office of policy-management-and-
scheduled-review-and-revision is responsible for revision and
improvement of this policy on an annual basis.
(etc.) …b. Procedures for Modification
“The <case organization> office of policy-management-and-
scheduled-review-and-revision will solicit recommendations for
revision and improvement through the anonymous web form
located at http://www.<case organization>.org/anonymous-
policy-recommendations-for-revision-and-improvement.html.”
“Revised policies will be circulated for comment for a period of
not more than 30 days following a review cycle, to allow
recommendations for improvement, before submission to
management for formal approval…”
“Revised and approved policies will be distributed via the <case
organization> policy administration site located at
http://www.<case organization>.org/policy-training-
distribution-comprehension-understanding-and-
enforcement.html, where formal policy training and compliance
will be conducted…”
“All individuals specified in Sections 1.a. and 1.c. above are
expected to complete annual training and certification on this
policy annually…”
(etc.) …7. Limitations of Liabilitya. Statements of Liability
A general statement limiting the liability of <case origination>
should a <issues> user violate policy and commit a crime in
doing so.

“<Case organization> accepts no liability associated with the
conduct of any individual violating this policy and in doing so
committing a crime…”
“Further, <case organization> will assist in the prosecution of
any individual who does so, so long as such legal actions are in
the best interest of <case organization> and its stakeholders…”
(etc.) …b. Other Disclaimers
A general statement covering anything not covered in 7.a.
above.
“This policy was created based on current local/state/federal
laws/regulations associated with and impacting <issues>, as of
the date indicated below. Any revisions to said laws/regulation
that may impact this policy will be taken into consideration
during the annual review process, or upon notification to <case
organization>’s legal counsel…”
(etc.) …
References
Here you should describe all references and support documents
used in the creation of this policy in APA format. Note any
quotation, paraphrasing, graphic, table etc. used from an outside
source must contain an in-text citation, as well as a reference
here. For the purposes of this project do not directly quote any
outside source other than in the Definitions section 1.b.
1
4

1 COMPUTER GAMING TECHNOLOGY INC., A Software-4-All Com

Recommended

Recommended

More Related Content

Similar to 1 COMPUTER GAMING TECHNOLOGY INC., A Software-4-All Com

Similar to 1 COMPUTER GAMING TECHNOLOGY INC., A Software-4-All Com (18)

More from VannaJoy20

More from VannaJoy20 (20)

Recently uploaded

Recently uploaded (20)

1 COMPUTER GAMING TECHNOLOGY INC., A Software-4-All Com