ERM Week 2 Assignment Answers

UNIVERSITY OF THE CUMBERLANDS

ITS 833 – INFORMATION GOVERNANCE

SUMMER IG – BI-TERM 2018

SEMESTER PROJECT – PHASE III

ADDITIONAL INFORMATION FOR PHASE III

Security Transport Professionals (STP) Incorporated desires to increase its share of the

transportation market for high risk, sensitive, top secret, regulated “goods” by establishing itself

as being the premier freight hauler who can rise to the task of moving its customer’s product to its

destination in the quickest, most efficient, confidential, safe and secure manner possible, while

maintaining a comparable cost of moving and storage. This means that it wants to be identified as

THE hauler who incurs the smallest amount of damage, destruction, and delays to the customer’s

product while the product is in STP’s care and possession, and who transports the product in a

legally defensible manner, exposing its customers the smallest legal exposure possible. STP’s

objectives include having a system of management and governance of its data that is readily

accessible for decision making, secure and exposes the organization to the smallest degree of risk

possible. The strategic plan for achieving this organizational objective includes designing,

planning, implementing, testing, auditing, evaluating, and continual updating or revising an overall

organizational Information Governance program that is aligned and synchronized with the

organizations’ overall strategic plans, goals and business objectives. The Information Governance

program should include key concepts from records management, content management,

Information Technology and data governance, information security, data privacy, risk

management, litigation readiness, regulatory compliance, long-term digital preservation and

business intelligence. To do this, STP recognizes that in order to support the organizational

objectives, its Information Governance (IG) goal must be to design and implement a plan/program

that provides for a standardized and systematized method of handling information wherein it can

efficiently analyze and optimize how information is accessed, controlled, managed, shared, stored,

preserved and audited.

During Phase I, you as the project manager have had an opportunity to give some thought to which

members of the organization you would want to have on your IG team from those listed in the

project description who have expressed an interest in assisting in the creation of the IG program at

STP. You have also had an opportunity to give some thought to what you expect might be the

greatest security risks that STP may face through your risk analysis and risk profile. You have

had an opportunity to research the differing regulations in the different states where STP operates

primarily. In Phase II you had an opportunity to consider the types of records STP deals with

through your records inventory for a least one area of the organization. You have considered a

records retention plan and have identified the types of records that may be periodically tagged for

destruction, which should be archived, and which are subject to long term digital preservation.

You are now ready to design your first Information Governance Program.

While it should go without stating, information related to each of STP’s customers and their

products is highly sensitive, and in some cases top secret. You want to make sure that the IG

Program that STP implements will allow STP to retain all of the information about its customers,

the product transported, and the particular haul that it is required to keep pursuant to federal and

state law. You want to insure STP that the proper information will be retained that it might need

for purposes of litigation and e-discovery. You will need to consider disaster recovery and business

continuity. You don’t want STP to keep unnecessary information for extended periods of time,

thereby increasing the cost and time involved with processing and retention, and also increasing

STP and its customers to litigation risks. Therefore, you will want to give serious consideration

to STP’s data disposition or disposal plans.

INSTRUCTIONS FOR PHASE III

You are to prepare an Information Governance Policy/Program for STP. All IG policies or

programs are somewhat different and unique to the industry and to the organization. There are a

number of sample Information Governance Policy/Program templates and samples on the internet.

Attached to the end of this document is a sample Information Governance Policy template that was

copied verbatim from the website https://www.infogovbasics.com/creating-a-policy/.

Please feel free to browse the internet to get a flavor for what an actual IG Policy/Program might

look like. If you desire, use the template attached to the end of this document as an outline for how

you might choose to format your IG Policy/Program for STP and what you might want to include

in your IG policy/program. It is certainly not a requirement that you use the attached sample as a

guideline for formatting your own. You may determine that you have something better! This

sample at the end of this document is merely attached as one example of what might be contained

in your IG policy/program, and in what format. Browse as much as you want to determine how

you want to format your own IG Policy/program, and the types of things you will include. Even if

you do decide to use the attached sample, still you are required to customize this sample to meet

the distinct characteristics and needs of STP.

Please do not misconstrue the sample/example format attached hereto. You must complete the

actual content or provide instruction for each section listed, and include your own sections where

appropriate. For example, you will see on one portion of the attached example the following:

Roles and Responsibilities

The first major section of most frameworks clearly define key roles and their responsibilities, including:

Information Governance Committee

Information Governance Team

Information Risk Management

Information Asset Management

Records Manager

Line-of-Business Managers

Employees

“Roles and Responsibilities” is merely a category or heading for one portion of the IG

policy/program. The sentence that reads, “The first major section of most frameworks clearly

define key roles and their responsibilities including:” is nothing more than an instruction from

me to you describing the section. Then the 7 lines that follow is just an example of the key

players for this particular example. It still needs to have the roles and responsibilities inserted

and described in sentence form for each of those 7 positions listed. So you will not include in

your IG policy/program my description of what each category is used for. Please remember that

I said I want you to use sentence form. Please don’t just give me listings like each of the 7 listed

in the Roles and Responsibility example above. The IG policy/program that you submit should

be so much more than just bullet items with sentences of explanation. You will lose a significant

number of points if you decide to give me bulleted items only.

However, please, please, please do not plagiarize by copying another IG policy that you find on

the internet (or anywhere else). Remember I will run the IG Policy that you submit through a

plagiarism checker that will compare it with others on the web and with those of the other students

in the class. Where it finds a match it will give me the source. In addition, it will break down your

paper and will tell me what percentage of your entire paper was plagiarized from different sources.

If you use anything from an IG policy that you find on the Internet, please give credit to the source

so that the plagiarism issue will not come up. If you find a good IG policy/program on the internet,

or from any other source, please give credit to the source by listing it as a reference. If you use

the sample that is attached hereto, please reference it as well. References should be in the form of

endnotes, and not footnotes as footnotes would most likely detract from the IP Policy/Program.

The IG Policy that you develop should be specific to STP and unique to the organization’s needs.

Where you decide that STP should use cloud computing, mobile devices, and to the extent that

you decide that it is appropriate for STP to engage in enterprise social media, state the decisions

you have made as those things will be reflected in your IG policy. Explain any decisions or

assumptions you have made for STP that were not outlined in the description of the company.

This phase (phase III) of your project is due no later than Monday, June 25, 2018 at 11;30 p.m.

Eastern Standard Time. This is an extension for the deadline for submitting phase III and a

departure from the deadline given in the syllabus. Make sure to submit the project in WORD

format. Use 1 inch top, bottom, left and right margins on each page. Include a cover page that

will contain the Course name and number, semester term, your full name, student id, and the title

“STP INFORMATION GOVERNANCE POLICY/PROGRAM IMPLEMENTATION

PHASE III”.

This portion of the semester project is worth 10% of the overall grade. You should submit this

assignment using iLearn. Go to the content section where you will see a folder labeled

“SEMESTER PROJECT-STP”. Select that folder. You will then see selections for submitting

Phases I, II and III. Please select Phase III, then and upload the WORD document that you

created. This assignment must be submitted no later than 11:30 p.m. Eastern Standard Time on

Monday, June 25, 2018. Assignments will not be accepted late. This means that you should not

plan to contact me at 11:35 p.m. or 11:59 p.m. and tell me that you thought Phase III was due at

midnight, or any time other than 11:35 p.m.

SAMPLE TEMPLATE FOR FORMAT AND CONTENT OF AN INFORMATION GOVERNANCE POLICY

The remainder of this paper was reproduced for educational purposes in its entirety from: https://www.infogovbasics.com/creating-a-policy/

A Definition of Scope

The framework should begin by establishing the full extent of the Information Governance program. An example of this could be:

“The Information Governance framework covers all staff that create, store, share and dispose of information. It sets out the procedures for sharing information with stakeholders, partners and suppliers. It concerns the

management of all paper and electronic information and its associated systems within the organization, as

well as information held outside the organization that affects its regulatory and legal obligations.”

Roles and Responsibilities

The first major section of most frameworks clearly define key roles and their responsibilities, including:

Information Governance Committee

Information Governance Team

Information Risk Management

Information Asset Management

Records Manager

Line-of-Business Managers

Employees

Information Policies

Information Governance covers a wide range of policies. The framework should set out which corporate policies are relevant to the Information Governance program. These may include:

 Information security policy

 Records management policy

 Retention and disposal schedules

 Archiving policy

 Data privacy policy

 ICT policy

 Information sharing policy

 Remote working policy

Information Procedures

A major part of the Information Governance framework should set out how the organization and its employees work with information. This can be broken into separate sections covering:

 Legal and regulatory compliance

 Creating and receiving information

 Acceptable content types

 Managing the volume of information

 Managing personal information

 Storing and archiving information

 Collaboration and sharing information

 Disposing of information

Working with Third Parties

As more and more information that affects a business is created and stored elsewhere it is essential to establish how the organization operates and shares information with stakeholders, partners and suppliers. The framework should:

 Define the policies for sharing information with third parties

 Define how the organization can manage how third parties handle personal and confidential information

 Define how Information Governance fits within supplier relationships and contractual obligations

 Define measurement and metrics for third party meeting the organization’s Information Governance

goals

Disaster Recovery, Contingency and Business Continuity

The framework should set out the organization’s approach to:

 Reporting information losses

 Reporting information security breaches

 Incident management and escalation

 Back up and disaster recovery

 Business continuity management

Auditing, Measurement and Review

Information Governance is a continuous improvement process so it must be underpinned by a continuous monitoring procedure. The framework can set out the organization’s approach to:

 Monitoring information access and use

 Monitoring effectiveness of regulatory compliance

 Monitoring the effectiveness of information security policy and procedure

 Monitoring of ICT and storage infrastructure performance

 Risk assessment and auditing

 Information Governance review

Like many things in Information Governance, there is a balance to be achieved with the Information Governance framework. The more comprehensive the document, the better. However, it shouldn’t become so large and unwieldy that it ends up gathering dust on the shelf.

Unit 2 Assignment – ERM at Mars, Incorporated: ERM for Strategy and Operations

ABC Organization is considering implementing an Enterprise Risk Management program. The board at

your organization where you are the risk manager has asked you to review this case study and present

information about the case study and your findings related to Risk Assessment Methodology.

The UK housing market is going through a difficult period. The number of households is expanding by 250,000 per year, but the rate of house building is only half of what it needs to be. There is a tradition of home ownership, but the banking sector has recently not been able (or willing?) to fund further growth, and home ownership has fallen to its lowest level for two decades. Young working people who would previously have taken out a mortgage and bought their houses are now turning to renting. There is an urgent need to provide ordinary working people with good quality homes; the private rental market provides homes of mainly low quality, and market rents are increasing to unaffordable levels. Read the Housing Association Case Study of ERM in a Changing Marketplace, prepare your responses to the following questions in a presentation to be made to your board of directors.

1. Given the fact that the association is a charity, with risks related both to its financial and charitable aims and any profits made being reinvested to support its charitable aims,, what do you assess as the biggest risks facing the association and what is your assessment of these risks? Note that “for-profit” activities such as building houses for sale can also contribute to an association’s aims (e.g., to provide affordable housing within its chosen area of operation).

2. Considering the list of products in the “Background” section, how do you rate their potential risks and returns for the association, again in relation to its charitable aims and viability constraints and in the context of the association’s operating environment?

3. In the light of the association’s financial position and its charitable aims, how high should be the risk appetite of the association? Is one of the generic strategies listed in the “Sector Issues” section appropriate for the association, and if not, then what should the association’s strategy be?

4. Can you suggest product growth targets and appropriate risk limits that will enable the association to develop safely and dynamically in the short/medium term? The association data was drawn in 2013 from current real cases, and it may help you to investigate the “actual” cases and their contexts.

Make sure to provide a reference slide that provides APA citations of any sources used in the PowerPoint presentation. This slide does not require narration. Oral Parameters/Expectations: 1. At least 10 slides in length, with each slide having a narration in Standard English explaining the key ideas in each slide. 2. The oral presentation should have a highly developed and sustained viewpoint and purpose. 3. The oral communication should be highly ordered, logical and unified. 4. The oral delivery technique, including word choice and oral expressiveness, displays exceptional content, organization, and style, while leading the audience to a dynamic and supported conclusion. 5. Free of grammatical errors.

6. No evidence of plagiarism.

7. Ensure that the narration provides clear enunciation, a professional tone, and is free of background noise. 8. The slide presentation must be professional and utilize a professional background and design. 9. All slides must have notes or a script for the verbal presentation given. The script will be entered into the plagiarism checker as well. Written Requirements Your PowerPoint narration presentation should be 10 or more slides in length. There should be a minimum of 5 references. Be sure to use appropriate APA format and cite your Reading or other sources that you used in your presentation. The presentation should contain enough information to adequately answer the questions and contain no spelling, grammar, or APA errors. Remember that the slides will contain summary information of what you provide in your narration. Points deducted from grade for each writing, spelling, or grammar error are at your instructor’s discretion. Also review the university policy on plagiarism. If you have any questions, please contact your professor. Directions for Submitting Your Assignment Place your presentation in the drobox for Unit 2 Assignment.