WATERWORLD WATERPARKS

Information Security Policy
Version 1.0 Revision 191
Approved by John Smothson Published DATE March 23, 2011

CONFIDENTIAL/SENSITIVE INFORMATION
This document is the property of WATERWORLD WATERPARKS. It contains information that is proprietary, confidential, sensitive or otherwise restricted from disclosure. If you are not an authorized recipient, please return this document to WATERWORLD WATERPARKS, Attention: IT Director. Dissemination, distribution, copying or use of this document in whole or in part by anyone other than the intended recipient is strictly prohibited without prior written permission of WATERWORLD WATERPARKS Executive Management.

Revision History Changes | Approved By | Date | Initial Publication | John Smothson | 3-23-2011 | | | | | | | | | | | | | | | | | | | | | | | | | | | |

Table of Contents
1 Introduction and Scope 8
1.1 Introduction 8
1.2 Payment Card Industry (PCI) Compliance 8
1.3 Scope of Compliance 8
2 Policy Roles and Responsibilities 10
2.1 Policy Applicability 10
2.2 Information Technology Manager 10
2.3 Information Technology Department 11
2.4 System Administrators 12
2.5 Users – Employees, Contractors, and Vendors 12
2.6 Human Resource Responsibilities 12
2.6.1 Information Security Policy Distribution 13
2.6.2 Information Security Awareness Training 13
2.6.3 Background Checks 13
3 IT Change Control Policy 15
3.1 Policy Applicability and Overview 15
3.2 Change Request Submittal 15
3.2.1 Requests 15
3.2.2 Request Approval 15
3.2.3 Request Management 17
3.2.4 Projects 17
3.3 Change Request Approval 18
3.4 Project Approval 18
3.5 Change Testing 19
3.6 Change Implementation 19
3.6.1 Release 19
3.6.2 Release Approval 19
4 Data Classification and Control Policy 20
4.1 Policy Applicability 20
4.2 Data Classification 20
4.2.1 Introduction 20
4.2.2 Information Categories