1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T Series X TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU Supplement 27 (09/2016) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY ITU-T X.1054 Best practice for implementation of Recommendation ITU-T X.1054
2、| ISO/IEC 27014 on governance of information security Case of Burkina Faso ITU-T X-series Recommendations Supplement 27 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NET
3、WORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.10
4、29 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer securi
5、ty X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X
6、.1339 PKI related Recommendations X.1340X.1349 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identif
7、ication and discovery X.1570X.1579 Assured exchange X.1580X.1589 CLOUD COMPUTING SECURITY Overview of cloud computing security X.1600X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X
8、.1679 Other cloud computing security X.1680X.1699 For further details, please refer to the list of ITU-T Recommendations. X series Supplement 27 (09/2016) i Supplement 27 to ITU-T X-series Recommendations ITU-T X.1054 Best practice for implementation of Recommendation ITU-T X.1054 | ISO/IEC 27014 on
9、 governance of information security Case of Burkina Faso Summary To create value, the information should be governed within the organization so as to have a strategic alignment between the objectives of information security and those of the organization. Governance and management of information secu
10、rity should be conducted in complete synergy. The management should be responsible for the operation of information and reporting (idea of responsibility) to the governing body. To achieve this, the organization can use standards, recommendations and other frameworks whose implementation will encour
11、age its success. It is in this spirit that Recommendation ITU-T X.1054 | ISO /IEC 27014 is implemented to the governance of information security of e-Council of Ministers in Burkina Faso. This approach aims to be a case of best practice in the implementation of Recommendation ITU-T X.1054 | ISO /IEC
12、 27014. Here it is used as part of a unifying project gathering all members of the Government of Burkina Faso (Presidency, Prime Ministry, General Secretariat of the government and the Council of Ministers, all ministries). However, this Supplement could be applied to any type of organization. Histo
13、ry Edition Recommendation Approval Study Group Unique ID* 1.0 ITU-T X Suppl. 27 2016-09-07 17 11.1002/1000/13072 Keywords Governance of information security, Governance model, ITU-T X.1054 | ISO/IEC 27014. * To access the Recommendation, type the URL http:/handle.itu.int/ in the address field of you
14、r web browser, followed by the Recommendations unique ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii X series Supplement 27 (09/2016) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and
15、 communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide bas
16、is. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resol
17、ution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this publication, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and
18、 a recognized operating agency. Compliance with this publication is voluntary. However, the publication may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the publication is achieved when all of these mandatory provisions are met. The wo
19、rds “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the publication is required of any party. INTELLECTUAL PROPERTY RIGHTSITU draws attention to the possibility that th
20、e practice or implementation of this publication may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the publication develo
21、pment process. As of the date of approval of this publication, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this publication. However, implementers are cautioned that this may not represent the latest information and are therefore str
22、ongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2016 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. X series Supplement 27 (09/2016) iii Table of Contents Page 1 Scope . 1 2
23、 References . 1 3 Definitions 1 4 Abbreviations and acronyms 1 5 Extracts from Recommendation ITU-T X.1054 | ISO/IEC 27014 . 1 5.1 Objectives ITU-T X.1054 1 5.2 Desired outcomes ITU-T X.1054 2 5.3 Governance of information security/Principles and processes . 2 6 Description of e-Council of Ministers
24、 2 6.1 Process of Council of Ministers documents . 3 6.2 Existing eCM administration and management bodies 5 7 Structure of information security governance for the e-Council of Ministers 5 7.1 Functions 5 7.2 Principal bodies 7 8 Mapping between the e-Council of Ministers and ITU-T X.1054 | ISO/IEC
25、27014 11 X series Supplement 27 (09/2016) 1 Supplement 27 to ITU-T X-series Recommendations ITU-T X.1054 Best practice for implementation of Recommendation ITU-T X.1054 | ISO/IEC 27014 on governance of information security Case of Burkina Faso 1 Scope This Supplement describes a best practice case f
26、or the implementation of guidelines provided by ITU-T X.1054. ITU-T X.1054 provides concepts and guidance on the principles and the processes for the governance of information security, by which organizations can evaluate, direct and monitor the management of information security. This Supplement sh
27、ows how ITU-T X.1054 is implemented in an organization, in particular the government of Burkina Faso, to set up a model for the information security governance. It also provides a mapping between the model, principles and processes of ITU-T X.1054. 2 References ITU-T X.1054 Recommendation ITU-T X.10
28、54 (2012) | ISO/IEC 27014:2013, Information technology Security techniques Governance of information security. 3 Definitions This Supplement uses the definitions given in ITU-T X.1054. 4 Abbreviations and acronyms This Supplement uses the following abbreviations and acronyms: A Assure C Communicate
29、CIO Chief Information Officer D Direct E Evaluate eCM e-Council of Ministers (e-Conseil des Ministres) ICT Information and Communication Technology IT Information Technology M Monitor 5 Extracts from Recommendation ITU-T X.1054 | ISO/IEC 27014 This clause holds extracted portions from ITU-T X.1054.
30、5.1 Objectives ITU-T X.1054 The objectives of governance of information security are to: align the information security objectives and strategy with business objectives and strategy (strategic alignment), 2 X series Supplement 27 (09/2016) deliver value to the governing body and to stakeholders (val
31、ue delivery), ensure that information risk is being adequately addressed (accountability). 5.2 Desired outcomes ITU-T X.1054 The desired outcomes from effectively implementing governance of information security include: governing body visibility on the information security status, an agile approach
32、to decision-making about information risks, efficient and effective investments on information security, compliance with external requirements (legal, regulatory or contractual). 5.3 Governance of information security/Principles and processes Governance of information security involves applying rule
33、s adopted at principles level and perform the tasks described in processes. This clause describes the tasks required from the governing body to establish governance of information security. 5.3.1 Principles Governance principles of information security are rules to be respected for the implementatio
34、n of the governance. They constitute a sort of implementation guide. Each principle is characterized by what should happen (outcomes), but does not prescribe how, when (deadline) or by whom (responsible) the principle would be implemented. There are six principles (actions to apply) to align informa
35、tion security with the goals of business. These include: Principle 1 (P1): Establish organization-wide information security; Principle 2 (P2): Adopt a risk-based approach; Principle 3 (P3): Set the direction of investment decisions; Principle 4 (P4): Ensure conformance with internal and external req
36、uirements; Principle 5 (P5): Foster a security-positive environment; Principle 6 (P6): Review performance in relation to business outcomes. 5.3.2 Processes Governance processes for information security (i.e., Evaluate (E), Direct (D), Monitor (M), Communicate (C) and Assure (A) describe a set of tas
37、ks to be performed to implement the governance of information security and the relationships between these tasks. Every governance model is an integral component of the governance of an organization, which emphasizes the importance of alignment with the business objectives. It is usually beneficial
38、for the governing body to develop a holistic and integrated view of its governance model, of which governance of information security should be a part. In this Supplement, Burkina Fasos case is introduced. This case is based on the existing bodies to establish and implement the governance of informa
39、tion security of e-Council of Ministers (eCM). 6 Description of e-Council of Ministers The aim of “e-Council of Ministers (eCM)“ (e-Conseil des Ministres) or “Paperless Council of Ministers“ is to ensure the total virtualization of document processing, from drafting in ministerial departments to fin
40、al archiving after their adoption by the Council of Ministers. X series Supplement 27 (09/2016) 3 6.1 Process of Council of Ministers documents The process of Council of Ministers documents comprises the following eight steps: Step 1 Producing documents by ministerial departments Inputs Actors Outpu
41、ts 1. Basic documents 2. Ideas 1. Minister 2. General Secretary 3. Chief of minister staff 4. Technical advisors 1. Reports on draft decrees 2. Reports on preliminary draft laws 3. Statements by council of ministers 4. Other reports Step 2 Evaluate documents by the General Secretariat of the governm
42、ent and of the Council of Ministers Inputs Actors Outputs 1. Reports on draft decrees 2. Reports on preliminary draft laws 3. Statements by council of ministers 4. Other reports 1. General Secretary of Government 2. Deputy-General Secretary of Government 3. Special advisers 1. Documents 2. Notes / r
43、emarks / comments Step 3 Setting the agenda Inputs Actors Outputs 1. Documents validated by the General Secretariat of Government 2. Draft agenda 1. Prime Minister 2. General Secretary of Government / Deputy-General Secretary of Government 1. Scheduled documents 2. Agenda Step 4 Examination of docum
44、ents tabled for discussion in the Council of Ministers Inputs Actors Outputs 1. Scheduled documents 2. Agenda 1. Minister 2. General secretary 3. Chief of minister staff 4. Technical advisors 1. Scheduled documents 2. Agenda 3. Notes / remarks / comments made by each ministry Step 5 Meeting with the
45、 Council of Ministers Inputs Actors Outputs 1. Scheduled documents 2. Agenda 3. Notes / remarks / comments made by each ministry 1. President 2. Prime Minister 3. All ministers 4. General Secretary of Government 1. Scorecard or tracking sheet of the council by General Secretary of Government 2. Coun
46、cil report 3. Adopted texts 4. Withdrawn, rejected or renewed texts 5. Tracking sheet (by each minister) Step 6 Finalization of texts adopted in the Council of Ministers 4 X series Supplement 27 (09/2016) Inputs Actors Outputs 1. Agenda 2. Adopted texts 3. Tracking sheet of ministers council 4. Repo
47、rt of ministers council 5. Tracking sheet (by each minister) 1. Government members concerned with issues 2. General Secretary of Government 3. Deputy General Secretary of Government 4. Ministerial staff concerned with issues 5. Special advisors of General Secretary of Government 1. Finalized texts 2
48、. Adopted draft laws Step 7 Signature Inputs Actors Outputs 1. Finalized texts 2. Passed laws 1. President 2. Prime Minister 3. Government members concerned with issues 4. General Secretary of Government 1. Signed texts 2. Passed laws Step 8 Publication and archiving Inputs Actors Outputs 1. Signed
49、texts 2. Passed laws 1. Director of Legal Department (General Secretariat of Government) 2. Director of Department of ICT and archives (General Secretariat of Government) 3. Director of Library Department (General Secretariat of Government) 1. Official newspaper 2. Archives In addition to these steps, inter-ministerial collaboration is also possible with regard to documents that concern decisions by more than one ministry. Council of
