The document outlines a system-specific security policy (SySSP) for a project, detailing roles and responsibilities for involved personnel such as the project lead, CEO, CISO, and SSE. It includes guidelines for access control lists, matrices, capability tables, configuration rules, and technical specifications regarding assets like servers and user equipment. The policy serves as a structured framework to ensure security measures are implemented effectively within an organization.

1. System-Specific Security Policy (SysSP)
Class: CISS-391 Early Spring 2020
Policy Information
Policy Name: __________________________ ID:
______________ Type: ☐ Internet, ☐ Networks, Systems, ☐
Information
Company/Agency/Organization:
___________________________________ Date:
_____________
Team Name: _______________________________ Project
Lead: ___________________________
Chief Executive Officer (CEO): ______________________
Role(s): Define your role(s) for this policy
Chief Info Security Officer (CISO): ___________________
Role(s): Define your role(s) for this policy
Senior Security Engineer (SSE): _____________________
Role(s): Define your role(s) for this policy
☒ Systems, ☒ InformationSysSP Details:
1. Access Control list (ACL)
(see pg 189 Fig 4-3)
[Group name, Description, user account type: ADMIN,
EMPLOYEE, CONTRACTOR, USER, GUEST]
Group
Description
Account Type
Admin
System and network administrators

2. 2. Access Control matrix
(focus on user access)
[user account type, group, asset, control, time limits] Hint: one
user per policy
Account Type
Group
Assert
Control
Time limits

3. 3. Capability table

4. (Focus on control capabilities: (account office apps, system
tools, network tools, policy that applies) (Policy control for
above users and groups)
Group
Account Type
Capability tools
Policy that apply

5. 4. Configuration rules
(focus on assets like servers) (server, port, protocol, access
rule, time limits)
Server
Port(s)
Protocol
Access Rule
Time limit

6. 5. Technical Specifications SysSP
(Focus on asset hardware both network equipment, servers, and
user PCs/Laptop) (Make, model, type, Quantity, cost)
Asset Type
Make
Model
Qty
Cost

8. References:
Page 2 of 2