Methods and systems for determining security requirements for an information resource

A system for determining security requirements for an information resource, the system comprising:

• a memory storage for maintaining a database;
• and
• a processing unit coupled to the memory storage, wherein the processing unit is operative to
• determine a privacy policy governing information maintained by the information resource;
• assign sensitivity levels to individual data elements based on user input;
• determine a sensitivity level for the information resource based on the sensitivity levels of the individual data elements, the determined sensitivity level of the information resource corresponding to the highest sensitivity level of the individual data elements;
• assign the determined highest sensitivity level to the information resource to implement the privacy policy;
• determine a criticality level associated with the information resource, the criticality level corresponding to an impact if the information resource were to become unavailable;
• determine security requirements for the information resource based on at least one of the determined sensitivity level and the criticality level to enforce the privacy policy governing the information maintained by the information resource;
• and
• store the determined sensitivity level, the criticality level, and the security requirements in the database;
• wherein the security requirements include at least one of baseline security requirements, mandatory security requirements, discretionary security requirements, and discretionary security requirements treated as mandatory;
• and
• wherein the baseline security requirements comprise security requirements to protect infrastructure.

A computer-readable hardware medium which stores a set of instructions which when executed performs a method for determining security requirements for an information resource, the method comprising:

• determining a privacy policy governing information maintained by the information resource;
• assigning sensitivity levels to individual data elements based on user input;
• determining a sensitivity level for the information resource based on the sensitivity levels of the individual data elements, the determined sensitivity level of the information resource corresponding to the highest sensitivity level of the individual data elements;
• assigning the determined highest sensitivity level to the information resource to implement the privacy policy;
• determining a criticality level associated with the information resource, the criticality level corresponding to an impact if the information resource were to become unavailable;
• and
• determining security requirements for the information resource based on at least one of the determined sensitivity level and the criticality level to enforce the privacy policy governing the information maintained by the information resource;
• wherein the security requirements include at least one of baseline security requirements, mandatory security requirements, discretionary security requirements, and discretionary security requirements treated as mandatory;
• and
• wherein the baseline security requirements comprise security requirements to protect infrastructure.

A method for determining security requirements for an information resource, using a computer system, the method comprising:

• assigning, by the computer system, sensitivity levels to individual data elements based on user input;
• determining, by the computer system, a sensitivity level for the information resource based on the sensitivity levels of the individual data elements, the determined sensitivity level of the information resource corresponding to the highest sensitivity level of the individual data elements;
• assigning, by the computer system, the determined highest sensitivity level to the information resource to implement privacy requirements of information maintained by the information resource;
• determining, by the computer system, a criticality level associated with the information resource, the criticality level corresponding to an impact if the information resource were to become unavailable;
• and
• determining, by the computer system, security requirements for the information resource based on at least one of the determined sensitivity level and the criticality level;
• wherein the security requirements include at least one of baseline security requirements, mandatory security requirements, discretionary security requirements, and discretionary security requirements treated as mandatory;
• and
• wherein the baseline security requirements comprise security requirements to protect infrastructure.

A system for determining security requirements for an information resource, the system comprising:

• a memory storage for maintaining a database;
• and
• a processing unit coupled to the memory storage, wherein the processing unit is operative to
• assign sensitivity levels to individual data elements based on user input;
• determine a sensitivity level for the information resource based on the sensitivity levels of the individual data elements, the determined sensitivity level of the information resource corresponding to the highest sensitivity level of the individual data elements;
• assign the determined highest sensitivity level to the information resource to implement privacy requirements of information maintained by the information resource;
• determine a criticality level associated with the information resource, the criticality level corresponding to an impact if the information resource were to become unavailable;
• determine security requirements for the information resource based on at least one of the determined sensitivity level and the criticality level;
• and
• store the determined sensitivity level, the criticality level, and the security requirement in the database;
• wherein the security requirements include at least one of baseline security requirements, mandatory security requirements, discretionary security requirements, and discretionary security requirements treated as mandatory;
• and
• wherein the baseline security requirements comprise security requirements to protect infrastructure.

A computer-readable hardware medium which stores a set of instructions which when executed performs a method for determining security requirements for an information resource, the method executed by the set of instructions comprising:

• assigning sensitivity levels to individual data elements based on user input;
• determining a sensitivity level for the information resource based on the sensitivity levels of the individual data elements, the determined sensitivity level of the information resource corresponding to the highest sensitivity level of the individual data elements;
• assigning the determined highest sensitivity level to the information resource to implement privacy requirements of information maintained by the information resource;
• determining a criticality level associated with the information resource, the criticality level corresponding to an impact if the information resource were to become unavailable;
• and
• determining security requirements for the information resource based on at least one of the determined sensitivity level and the criticality level;
• wherein the security requirements include at least one of baseline security requirements, mandatory security requirements, discretionary security requirements, and discretionary security requirements treated as mandatory;
• and
• wherein the baseline security requirements comprise security requirements to protect infrastructure.