ISSC499 final

Archiving Procedures: To ensure the retention and accessibility of all security communications, the following archiving procedures will be implemented:

Central Repository: The security communications such as the emails, alerts, and updates that are used will be well stored in a secure common database (Siam et al., 2021). This repository is going to be work in a secured network, whereby access to the structure will only be granted to authorized people only, and the structure adopted will enable easy retrieval of stored information.

Indexing and Searchability: The repository will contain documents; however, the documents are to be indexed and the search facility will enable users to search for documents of their interest easily.

Archival Process: At the close of every year, the document that is more than five years old will be transferred to the long-term storage archive (Solovyev, 2020). It will be saved and updated just like the main repository, with the same stringent security measures.

Backup Procedures: A daily, weekly, or monthly backup of the repository will be produced to avoid loss of information. These backups shall be kept in a secondary location different from the main backup store.

Initial Review: All communications drafts will be checked by the Cybersecurity Director or any other officer authorized by that person.

Content Verification: The first filter will check the relevance and the conciseness of the self-generated communication content.

Legal Review: Any communication relating to legal and or regulatory matters will be forwarded to the legal division for scrutiny.

Legal Assessment: The legal aspect will be evaluated by the legal department to look for any legal issues that may be encountered in its implementation and to get confirmation that the communication meets legal requirements.

Legal and Regulatory Requirements: The security communications plan will comply with the following legal and regulatory requirements:

General Data Protection Regulation (GDPR): To guarantee all the correspondence processing the personal data meets the requirements of the GDPR (Kuner et al., 2021).

Data Protection Impact Assessment (DPIA): Pre-DPIAs will be undertaken for communications that are perceived to use a large number of personal data to conform to GDPR regulations.

Health Insurance Portability and Accountability Act (HIPAA): Privacy and confidentiality of information in communication, particularly that involved in the health sector (Semantha et al., 2020).

Protected Health Information (PHI) Handling: Any communications that include the PHI shall be done via encrypted media and only accessed by persons with the right permission in accordance with HIPAA regulations.

Sarbanes-Oxley Act (SOX): The continuous provision of adequate information on both financial and security affairs of the business to its stakeholders (Phillips-Pakkianathan, 2022).

SOX Compliance Audits: Special attention will be paid to compliance with financial and security communications with the SOX requirements with the help of regular audits.

Incident: Any occurrence which may result into uncontrolled change of information’s integrity, loss of confidentiality or accessibility.

Alert: An alert that can be the possibility of a security threat or actual occurrence.

Update: Updates on new developments in the security environment and or changes in the security policies.

Repository: A central site within which all documents and Messages are collected and actively processed.

Data Breach: Any unauthorized access to information that is sensitive, protected or confidential leading to vulnerability of its security (Shukla et al., 2022).

Encryption: This can be defined as the act of putting information or data into a form that cannot be understood by anyone without a decryption tool.

Two-Factor Authentication (2FA): An identity verification method where the user is required to give two dissimilar elements of identification.

There are three severity levels and four message types that have been identified as significant in the evaluation of a system. It is essential to know the correlation to understand the assessment of a system. Messages will be categorized based on severity levels and types to ensure appropriate and timely communication:

Critical: Actions prescribed: identifying content items and closing accounts; possible consequences: large loss of work.

Example: A data breach involving a customer's sensitive information.

High: There is always a need for an immediate response; a particular business division or organizational operation functionality will be severely affected.

Example: A serious network weakness in the company’s network communication has been identified.

Medium: Action that needs to be taken soon; moderate risk.

Example: General amendments of security measures that impact various sectors of the organization.

Low: Information only or low consequence; no direct response needed.

Example: Bi-monthly security policy revision.

Alerts: A text message alert that contains information on security threats or any occurrence of an incident.

Content: A brief description of the threat and action to be taken, along with the person to contact in case of an emergency.

Frequency: When felt necessary by the different authorities ranging from the national level and below, depending on threat levels (Rattay et al., 2021).

Updates: Periodic updates on its policies, alterations, or improvements to the customers.

Content: Specific information on where policies are proposed, when they will be implemented and how they will affect the business operations.

Frequency: On a monthly basis or when thought necessary.

Reports: Maintenance of other forms of records that may be related with security issues, reviews, or assessments.

Content: The report has detailed coverage of the event and incident descriptions, audit conclusions and suggestions.

Announcements: Awareness of information on security programs/activities (Wang & Lund, 2020).

Content: Main characteristics and features of new security measures, advantages of participation, and further requirements.

· "Executives": (1, 2),

· "IT Staff": (1, 1),

· "End Users": (2, 1),

· "Customers": (1, 0),

· "Partners": (2, 0),

This diagram shows how security-related information is passed within an organization, starting with the Cybersecurity Director, who sends emails with information and occasionally sends text messages to the executives, uses an internal portal to pass information to the IT staff whilst passing information to the end users, customers as well as partners by sending emails to them. Moreover, IT Staff interacts with End Users, Customers and Partners using the internal portal, thus conveying safety matters to all interested parties in a timely manner and through proper channels.