This is just a brief high-level list:
1. What are your needs?
2. What do you use the Internet for?
3. Do you run any public servers? What type?
4. Do you run any local servers? What type?
5. What new uses of the Internet does the company anticipate making in the next 12 months?
6. How many employees does the company have? How many people access the computer network?
7. What is the rate of personnel turnover?
8. What is the potential business impact of an outage?
9. What is the potential business impact of infiltration?
10. Are you an "attractive target," a "high value target" or a regular non-high tech, non-financial, low-profile business?
11. Are there any other security factors that you are concerned about?
The first 7 questions narrow in on the exposures needing protection.
The second 4 questions give an indication of how secure the protection needs to be.
The answers to these questions will lead to new questions customized for your client's situation.
The report should include a comparison of the costs of not having security versus the costs of acquiring security.
It is best to produce a range of alternate solutions with different costs and protection levels. This lets the client make the choice (and take more of the responsibility) for the business decision of which level is most appropriate.
 show feedback form
 close
by keith2468  edited by JMGullett
last modified: 2007-05-29 12:24:00 |
