become-itil-foundation-certified-abhinav-kaiser(www.ebook-dl.com)

Chapter 5 ■ Service Design
Policies do not cover the service provider alone, but also encompass customers.
You do not want customers to carry out illegal activities using your services, do you?
Information security policies are always made a part of SLRs, SLAs, OLAs, and UCs.
According to the ITIL service design publication, these are some of the various
policies that make up information security policy. This list is not comprehensive:
• An overall information security policy
• Use and misuse of IT assets policy
• An access control policy
• A password control policy
• An e-mail policy
• An Internet policy
• An antivirus policy
• An information classification policy
• A document classification policy
• A remote access policy
• A policy with regard to supplier access to IT service, information,
and components
• A copyright infringement policy for electronic material
• An asset disposal policy
• A records retention policy
A detailed study of the listed policies is not within the scope of the ITIL
Foundation exam.
5.7.3.3 Objectives of Information Security Management
To state it plainly, information security management exists to keep customer information,
data, assets, and all aspects of customer resources safe. If we take a step back, the
customer will have certain policies and guidelines in place for business security. The
purpose of information security management is to align with the business security and
ensure that CIA is intact.
Further, the objectives of information security management are as follows:
1. Confidentiality: Information can be accessed only by those
who are authorized.
2. Integrity: Information is accurate, complete, and is in
verbatim condition.
88