Reference no: EM132781791

Assignment - Software Engineering, CMMI, and ITIL

Part 1:

Overview
Realizing that an organization's CMMI level affects an organization's success on requests for proposals (RFPs), your CIO wants to get the software development processes to CMMI level 3. Your organization has started developing software applications and database systems for their customers. The CIO wants to ensure that the software development and database development processes are being properly managed and audited, and he wants to ensure that the organization begins taking the necessary steps to progress to CMMI level 3. In preparation for your response, review the CMMI information.

Instructions
IT managers will commonly manage software development and systems integration activities. Write a 3-5 page paper in which you:

Describe the software engineering process, the challenges in managing software development activities, and the potential interface issues from the software development perspective.

Analyze the CMMI levels and define a road map that the organization will need to follow to get their software development processes to CMMI level 3. Note: This is important because the CMMI level that an organization achieves impacts their software development reputation.
Explain the auditing tasks that must be performed in order to achieve level 3.

Determine the continuous assurance auditing activities that the organization will need to implement to help achieve CMMI level 3.

Analyze the ITIL service management guidelines and principles.

Examine how ITIL service management practices relate to CMMI levels and continuous service auditing.

Use at least three quality resources. Note: Wikipedia and similar websites do not qualify as quality resources.

Part 2:

Assignment - HIPAA and IT Audits

Overview

Imagine you are the information security officer at a medium-sized hospital chain. The CEO and the other senior leadership of the company want to ensure that all of their hospitals are and remain HIPAA compliant. They are concerned about the impact of the HIPAA Security and Privacy Rules on the organization. You begin looking at the information provided by the U.S. Department of Health and Human Services, HIPAA Enforcement, and are asked to provide an analysis of two of the cases found here with emphasis on what was done to resolve the compliance issues.

Instructions

Section 1: Written Paper

Noncompliance with HIPAA regulations can result in significant fines and negative publicity. To help ensure that your organization remains in compliance with HIPAA regulations, you have been asked to write a 3-5 page paper in which you:

1. Create an overview of the HIPAA security and privacy rules.
2. Analyze the major types of incidents and breaches that occur based on the cases reported.
3. Analyze the technical controls and the nontechnical controls that are needed to mitigate the identified risks and vulnerabilities.
4. Analyze and describe the network architecture that is needed within an organization, including a medium-sized hospital, in order to comply with HIPAA regulations.
5. Analyze how a hospital is similar to and different from other organizations in regard to HIPAA compliance.
6. List the IT audit steps that must be included in the organization's overall IT audit plan to ensure compliance with HIPAA rules and regulations.
7. Use at least three quality resources. Note: Wikipedia and similar websites do not qualify as quality resources.

Section 2: Network Architecture
1. Create a network architecture diagram (using Visio or an open-source equivalent to Visio for creating diagrams), based on the description of the network architecture that you defined above for the organization to comply with HIPAA regulations.
2. Include in the diagram the switches, routers, firewalls, IDS/IPS, and any other devices needed for a compliant network architecture.

Part 3:

Question 1. Describe two challenges unique to IT audit projects. Suggest an approach to mitigate each challenge you selected.
Based on the challenges identified, describe the controls that the project manager would need to implement to overcome potential project control issues.

Question 2. Analyze the identity and access management approach that organizations require to control access to their systems. Explain how the identity and access management approach would be influenced by the type of organization and its size.

Determine the identity and access management practices you would recommend for a small or medium-sized business concerned about IT budget.

Determine the identity and access management practices you would recommend for a large organization that is extremely concerned about protecting corporate information assets.

Provide a rationale for your responses.