Information Security Policy
Gennie Diamond
Axia College of University of Phoenix
IT/244 – Intro to IT Security
October 10, 2010

Executive Summary The goals of this information security policy will be to state the principles and guidelines for protecting the confidentiality, integrity, and availability of sensitive information and resources for XYZ Energy. This policy will set forth requirements for securing the network’s confidential information and data communications infrastructure, in addition to defining detailed policies in the areas of physical security, access control, and network security. Assumptions of the security plan defines physical security at each site for the environment around the network including entry control at each facility, the need and responsibilities of security staff, and issues around security in common areas. Information system security defines workplace protection and guidelines for storage, protection, and maintenance of hardware and network equipment. Access control policies address user enrollment and all network access privileges, along with identification and authentication process policies. Finally, network policies are defined for granting and managing network access while still protecting sensitive company data. Project constraints can include, but are not limited to, availability of resources needed to provide appropriate security for each defined security goal; time restraints for meeting these goals; issues relative to having multi-site facilities; and employee accountability for protecting the company assets and network operations.

Introduction XYZ Energy, a nuclear-powered generating company, has various locations throughout the United States. With 50 fully operational plants, only two locations serve as backup cold facility sites. The two backup sites, located in Orlando,