Blog post by Monique Lewis and Lori Kleckner on June 17, 2011
In this multi-series blog posting on security at public safety answering points and public safety organizations, our first blog provided background on how and where we obtained our information and discussed how we will provide information to you in future postings as they relate to the NG9-1-1 Security (NG-SEC) standard.
In this blog posting, we will discuss the first section of the NG-SEC standard, security policy and its effects on PSAPs. At a minimum, the NG-SEC required the following areas to be covered in policy:
- Senior Management Statement of Policy (Organizational Policy)
- Functional Policies
- Procedures
It is important that the senior management statement of policy identify an individual responsible for security. Additionally the senior management statement should describe the organization’s objectives and security goals in writing. We observed that many these senior management statements of policies do not exist among most of the 9-1-1 facilities we visited.
PSAPs have implemented functional policies in both formal and informal way among many PSAPs. Most PSAPs have solid hiring practices in place; authenticate passwords; and physical security policies implemented. Many PSAPs do not have wireless, remote, or incident response policies implemented at their facility. Although formal procedures seem to be a common practice among many PSAPs, we have discovered that informal procedures are just as widespread among the 9-1-1 community.
The 9-1-1 community should be aware that security policies are instrumental to an effective security program. Formalizing security policies into 9-1-1 facilities is the first step to getting the organization on the path toward mission success. Functional policies and procedures will aid in the prevention of the accidental release of sensitive information. Cyber security should be a part of everyone’s focus.
Our next blog posting will feature Information Classification and Protection.