Administrative Controls Paper
1. How do Administrative Controls demonstrate "due care?"
Administrative controls demonstrate “due care” because they are controls that meet a standard considered reasonable by most organizations that share similar backgrounds or work environments. Administrative controls that meet the standard of “due care” generally are easily achievable for an acceptable cost and reinforce the security policy of the organization. They must include controls that contribute to individual accountability, auditability, and separation of duties. Administrative controls define the human factors of security and involve all levels of personnel within an organization. They determine which users have access to what organizational resources and data. Administrative controls can be broken down into two categories: preventive administrative controls and detective administrative controls. Preventive administrative controls are techniques designed to control personnel’s behavior to assure the confidentiality, integrity, and availability of organizational information. Some examples of preventive administrative controls are: security awareness and technical training, separation of duties, disaster preparedness and recovery plans, terminating and recruiting procedures, and user registration for computer access.
2. How does the absence of Administrative Controls impact corporate liability?
The absence of administrative controls will have a negative impact on corporate liability. The main reason is that the organization has not put in place controls that meet a standard considered reasonable by most organizations that share similar backgrounds or work environments to protect data and resources. By not having these administrative controls in place, an organization can be held liable should a breach of security occur. An excellent example of a corporation held