Reference no: EM132805153

Managing an IT Infrastructure Audit

Overview

This assignment consists of four distinct elements: an internal IT audit policy, a management plan, a project plan, and a disaster recovery plan. You must submit all four sections as separate files. Name each file as indicated in the instructions below.

Make any assumptions needed for the completion of this assignment, and base your work on the following scenario:

You are an information security manager for a large national retailer and are directly responsible for the planning and oversight of IT audits. At the request of the board of directors, the CEO has tasked you with developing a plan for conducting regular audits of the IT infrastructure. The planning and management aspects of IT audit are critical to the overall success of the audit and, consequently the overall success of the systems implemented in the organization.

You must develop a policy for conducting IT audits and develop a project plan for conducting two-week IT audits.

In addition to the typical networking and Internetworking infrastructure of a medium-sized organization, the organization has the following characteristics:
• They have a main office and 268 stores in the United States.
• They use a cloud computing environment for storage and applications.
• Their IT infrastructure includes Cisco workgroup and core switches, Cisco routers, Cisco firewalls and intrusion prevention systems, and servers running Microsoft Windows Server 2012.
• They have over 1,000 desktops and approximately 500 organization-owned laptops at the main headquarters.
• They allow employees to bring their own devices into the organization; however, they are subject to search upon entry and exit from the building.
• They enable remote access to corporate information assets for employees and limited access to extranet resources for contractors and other business partners.
• They enable wireless access at the main office and the stores.
• They process an average of 67.2 credit card transactions per hour, every day, at each location, and via their corporate website.

Instructions

Section 1: Internal IT Audit Policy.
Write a 3-4 page paper in which you:
1. Develop an internal IT audit policy, which includes at a minimum:
o Overview.
o Scope.
o Goals and objectives.
o Compliance with applicable laws and regulations.
o Management oversight and responsibility.
o Areas covered in the IT audits.
o Frequency of the audits.
Use at least two quality resources. Note: Wikipedia and similar websites do not qualify as quality resources.

Section 2: Management Plan.

Write a 4-6 page paper in which you:
1. Explain the management plan for conducting IT audits, including:
o Risk management.
o System software and applications.
o Wireless networking.
o Cloud computing.
o Virtualization.
o Cybersecurity and privacy.
o BCP and DRP.
o Network security.
Use at least three quality resources. Note: Wikipedia and similar websites do not qualify as quality resources.

Section 3: Project Plan.
Use Microsoft Project or an open source alternative such as Open Project to:
1. Develop a project plan that includes the applicable tasks for each of the major areas listed below for each element of the IT audit mentioned above; plan for a two-week audit.
o Risk management.
o System software and applications.
o Wireless networking.
o Cloud computing.
o Virtualization.
o Cybersecurity and privacy.
o Network security.

Section 4: Disaster Recovery Plan.

Write a 5-7 page paper in which you:
1. Develop a disaster recovery plan (DRP) for recovering from a major incident or disaster affecting the organization.
o The organization must have no data loss.
o The organization must have immediate access to organizational data in the event of a disaster.
o The organization must have critical systems operational within 48 hours.

Include within the DRP the audit activities needed to ensure that the organization has an effective DRP and will be able to meet the requirements stated above.

Use at least three quality resources. Note: Wikipedia and similar websites do not qualify as quality resources.

Part 1

1. Disaster recovery planning is essential for a business to survive when unexpected events impact daily operations. Identify the areas of disaster recovery planning and preparedness you believe organizations are often lacking. Provide a rationale for your response.

2. Analyze and describe the key controls, especially nontechnical controls, that would ensure a business is prepared for a disaster. Elaborate on the impact that a disaster might have on the auditing process.

Part 2

1. Identify three challenges organizations face when implementing change and patch management processes for the first time. Make suggestions to address these challenges.

2. Suggest the elements of change and patch management that are most difficult to audit in a large corporate environment with multiple IT issues and changes occurring every day. Provide a rationale for your suggestions.

Part 3

1. Create a list of at least five auditing best practices for organizations to follow when implementing their quality assurance auditing programs.

2. Select the auditing best practices you feel are most difficult to implement and offer means of addressing them.

Attachment:- Managing an IT Infrastructure Audit.rar