Control Objectives: Leadership and high level objectives

Add inventoried assets to the asset register database, as necessary.

Analyze organizational objectives, functions, and activities.

Approve all compliance documents.

Assign the corporate governance of Information Technology to the compliance oversight committee.

Assign the review of Information Technology policies and procedures to the compliance oversight committee.

Communicate the Information Technology plans to all interested personnel and affected parties.

Conduct Quality Control to ensure adherence to Information Technology policies, standards, and procedures.

Define the Information Assurance strategic roles and responsibilities.

Document organizational objectives.

Document organizational procedures that harmonize external requirements, including all legal requirements.

Document the Authority Documents, legal jurisdictions, and Service Level Agreements with which the organization must comply regarding its Information Systems, Information Technology, and information.

Enforce a continuous Quality Control system.

Establish and maintain a Compliance Exception standard for compliance exceptions.

Establish and maintain a Governance, Risk, and Compliance awareness and training program.

Establish and maintain a Quality Management framework.

Establish and maintain a Quality Management program.

Establish and maintain a compliance oversight committee.

Establish and maintain a data classification scheme.

Establish and maintain a hardware asset inventory.

Establish and maintain a high-level Strategic Information Technology Plan.

Establish and maintain a rapport with business and technical communities throughout the organization to promote the value and importance of Information Security.

Establish and maintain a storage media inventory.

Establish and maintain an Information Architecture model.

Establish and maintain an Information Technology inventory with asset discovery audit trails.

Establish and maintain an information classification scheme.

Establish and maintain an information classification standard to use when establishing information impact levels.

Establish and maintain an organizational data dictionary, including data syntax rules.

Establish and maintain an overall Quality Management standard.

Establish and maintain full documentation of all policies, standards, and procedures that support the organization's compliance framework.

Establish and maintain policies, standards, and procedures used to manage compliance documents.

Establish and maintain sustainable infrastructure planning.

Establish and maintain tactical Information Technology plans and Information Technology projects in support of the Strategic Information Technology Plan.

Establish and maintain tactical Information Technology plans derived from the Strategic Information Technology Plan.

Establish and maintain the scope of the organizational compliance framework and Information Assurance controls.

Identify discrepancies between the asset register database and the Information Technology inventory, as necessary.

Identify processes, Information Systems, and third parties that transmit, store, or process Personally Identifiable Information.

Identify roles, tasks, information, systems, and assets that fall under the organization's mandated Authority Documents.

Include each Information System's system boundaries in the Information Technology inventory.

Include explanations, compensating controls, or risk acceptance in the compliance exceptions Exceptions document.

Include network equipment in the Information Technology inventory.

Include portable computing devices that store restricted data or restricted information in the Information Technology inventory.

Include software in the Information Technology inventory.

Include the General Support Systems and security support structure in the Information Technology inventory.

Involve the Board of Directors in Information Governance.

Leadership and high level objectives

Mirror the organization's business strategy during Information Technology planning in the Strategic Information Technology Plan.

Monitor and evaluate the implementation and effectiveness of Information Technology Plans.

Monitor regulatory trends to maintain compliance.

Review the compliance exceptions Exceptions document annually.

Use automated tools to collect Information Technology inventory information, as necessary.