|
What exactly is a Written Information Security Program (WISP)?
A WISP is simply an encompassing set of policies, procedures, standards and guidelines that address Information Security topics. A WISP focuses on the core Information Security principles of granting least privileges and ensuring the Confidentiality, Integrity, and Availability (CIA triad) of your company’s data. A WISP addresses a cohesive framework of policies ranging from acceptable use policies, to proper procedures for users to secure their laptops when traveling, to documenting standards such as a requirement for all computers to have antivirus installed. The 39 policy topics of the WISP provide an integrated and single reference point for all your Information Security documentation needs.
Does this apply to my business?
Yes. If you are a sole proprietor or if you have thousands of employees, this Written Information Security Program (WISP) is applicable. Most businesses with less than several hundred employees have a dedicated Information Security expert on staff, so we can augment your IT staff by providing this expertise at a cost all businesses can afford.
Regardless of the size of your business, it is becoming more common for businesses to require their partners to be compliant with industry regulations and be able to provide documented evidence. The WISP is ideally suited to help businesses become compliant with their requirements.
How is your policy manual different from the free templates I can find on the Internet?
The WISP is customized specifically for your company, as if you employed an Information Security professional to write a set of policies for your company in-house. With a lot of template sites, options are given to pick and choose policies. Realistically, unless you are trained in Information Security and legitimately know what components are required to meet compliance minimums with a law or regulation, you are assuming a significant liability. Without expertise, it is a situation of “the blind leading the blind” in selecting and implementing policies.
Why don’t I save money and create my own policies?
The expertise that has been drawn upon for the WISP covers over three decades of experience in mitigating risk for technical, operational, and physical threats. You are buying expertise. With a lot of lesser options on the Internet, you get what you pay for - it is as simple as that. When it comes to the liability facing your company, it would be careless to rely on amateur solutions. You use a CPA for your finances. You see a doctor for your medical care. Why would you rely on an amateur solution for your Information Security needs?
How can I justify the price?
The Written Information Security Program (WISP) is a fraction of the cost for a comparable product produced from an on-site consultant. The cost for an WISP through iSecurityPolicy.com is approximately 1/10th the expense of hiring an Information Security consultant to custom-build the same policies, procedures, standards, and guidelines you can buy through our website.
In comparison, the Written Information Security Program (WISP) is less expensive than the following:
- Average business-class router
- 3 hours of a security consultant’s time (estimate 20-30 hours for an on-site solution)
- 2 hours of a lawyer’s time to assist in a disciplinary action when an employee counters that he/she was never informed of any restrictions or prohibitions that would lead to employee termination or discipline
- Cleanup following a malware infection
- Loss of business prestige from being compromised
The thoroughness of the WISP is without rival for the cost.
Why is there only one version of the Written Information Security Program (WISP)?
As a Certified Information Systems Security Professional (CISSP), the primary author used his extensive experience and the ISO 17799/27002 guidelines to create a comprehensive policy manual for small and medium businesses. Standards are standards for a reason. If you "save money" on a lesser solution, you simply get what you pay for. Our goal is to provide a solution that meets what businesses face today and what they can expect to face in the future. That is why there is only one WISP, not “bronze, silver or gold” packages like some competitors offer - we know the standards and we created a WISP that meets our client’s business compliance requirements.
How is the WISP a “customized” set of policies?
Based on our extensive experience consulting with businesses on Information Security projects and documentation, we developed a very robust template of policies, procedures, standards, and guidelines that businesses require to meet compliance requirements. Since most compliance requirements are based on industry-recognized “best practices” and that standards are openly published, we were able to develop a modular approach to policies and create a customized template framework. This allows us to efficiently customize the policies for our clients.
Our solution is approximately 1/10th the cost of hiring a dedicated Information Security consultant to write policies for your company. The irony is that those Information Security consultants use the same basis of working off templates for their clients. The end result is the same that you get customized Information Security policies for an extremely affordable cost.
What do I get when I buy an WISP?
You get a customized, professional Written Information Security Program (WISP) that covers 39 specific topics of immediate concern to all businesses. As part of the customization, your company’s logo will be featured on the cover of the WISP and your company name will be embedded throughout the document. The format provided to customers comes in either Microsoft Word or Portable Document Format (PDF). By choosing the Word version, you are able to make your own modifications or customizations as you need.
What forms of payment do you accept?
All major forms of credit and debit card are accepted. We currently accept secure online payments through PayPal and we can also invoice, upon request. PayPal uses strong SSL encryption to secure transaction security. iSecurityPolicy.com does not have access to or retain your credit card information - all credit card transactions are processed directly by PayPal, which is PCI DSS compliant and a secure payment gateway.
Will the Written Information Security Program (WISP) have your logo or mine?
If you have a logo, have it ready at the time of purchase since you will be prompted to upload it. The cover page of the WISP will have your company's logo prominently displayed. The rest of the document will have your company name throughout, so anyone reading the document will get the feel the WISP was custom created and tailored to your company.
What if I do not have a logo?
You can have the manual printed without a logo if you do not currently have one or if you wish to leave the logo off the cover page. Regardless if you have a logo or not, your company’s name will be embedded throughout the WISP.
What do I need to provide?
We require a high-resolution company logo file (JPG, GIF or BMP), your company’s official name, and your company’s common name. You will be prompted to upload this information prior to payment and will be able to proof the cover page before finalizing the purchase.
|
Official Name (examples)
|
Common Name (examples)
|
|
Beaverton Metropolitan Chamber of Commerce
|
Beaverton Chamber
|
|
City of Beaver Springs
|
COBS
|
|
Sonoma Technology Consulting, LLC.
|
SonomaTech
|
|
Can I get the WISP with additional customization?
Yes. There is added cost involved due to labor incurred, but we can customize to meet your specific requirements. The WISP was developed to meet the need of virtually all small and medium businesses, so it is unlikely additional customization is required.
My company currently accept credit cards. What do I need to do to become PCI DSS compliant?
Only by meeting these four steps, will you be compliant with the PCI DSS.
Step 1: Purchase a Written Information Security Program (WISP)
Step 2: Implement the WISP to meet PCI DSS requirements 1 through 12
Step 3: Complete the annual Self Assessment Questionnaire (SAQ), based on Merchant type
Step 4: Perform a vulnerability assessment in order to meet the quarterly audit requirement
You need to meet ALL the requirements of the PCI DSS (e.g. purchase & implement the WISP), perform the annual SAQ, AND perform a quarterly network scan in order to be considered PCI DSS compliant.
What happens if my business is not PCI DSS compliant?
You will be in breach of contract - read your merchant service contract.
Some Merchant Service Providers (MSPs) charge a monthly fine for non-compliance. These MSPs will tack on charges onto merchants’ monthly statements until the merchant provides documentation of compliance. These are fines that the MSP can charge, since you signed the merchant service contract with them, giving them the power to do so.
For most merchants, it is an “ignorance is bliss” scenario until something goes wrong. When a fraudulent charge or data breach occurs, the merchant will be held liable for:
- the costs of replacing of compromised credit cards,
- notification costs,
- lawsuits,
- forensic examination of your network,
- and if you are still in business after everything is said and done, you will be elevated to a Level 1 merchant, which significantly enhances the costs and requirements to accept credit cards.
If you are a Small to Medium Business (SMB), your likely outcome is bankruptcy, since insurance will not cover your non-compliance expenses. With that in mind, the cost of the Written Information Security Program (WISP) is immensely affordable.
Is this software or a subscription service?
Neither. The Written Information Security Program (WISP) is a one-time purchase and no software needs to be installed. The WISP is delivered via e-mail as a Microsoft Word or PDF attachment. You can e-mail it to your users, post it to a file share, or print it out for users to read - you have the flexibility to deploy it as it best suits you.
How do I implement the policies once I buy the WISP?
The policies in the WISP can be implemented by your own staff or you can have your existing IT support assist in the implementation. Click here for a visual explanation of how simple it is to implement Information Security policies.
Note - Administrative changes require management to publish and enforce the new standards within the WISP, such as employee training or disciplining employees who violate regulations. Your current IT provider will be able to use the WISP as a "road map" to make any necessary corrections to your network, in regards to technical changes (e.g. upgrading hardware or implementing group policies).
How quickly can I receive my manual?
Turn around time is generally 1-2 business days. Upon completing the online transaction, you will receive a confirmation e-mail. The completed product will be delivered to the e-mail address used to register at the time of purchase.
As an IT consultant, can I custom-brand policies for my customer as a reseller?
Yes. We offer a Value Added Reseller (VAR) program for IT consultants. Please contact us and we can get the process implemented within a few business days.
What is the refund policy?
Due to the Intellectual Property (IP) nature of the Information Security products and services offered by iSecurityPolicy.com, we do not offer refunds once the product has been shipped. iSecurityPolicy.com stands behind its products and services. The primary author is a CISSP, MCSE, MBA and former military officer, so the quality of the work is equivalent to what is found in a Fortune 500 (enterprise class) environment. The solutions provided by iSecurityPolicy.com are based on industry-recognized best practices and standards - with many satisfied clients from around the country.
What expertise is relied upon for this Written Information Security Program (WISP)?
The WISP has been thoroughly peer-reviewed from members of the the IT, Information Security, Physical Security, and Legal professions for a very well-rounded and professional product. The lead author is a Certified Information Systems Security Professional (CISSP), Microsoft Certified Systems Engineer (MCSE), MBA, and former military officer with over 15 years of Information Security experience.
CISSPs must follow a strict code of ethics from the (ISC)2:
- Protect society, the commonwealth, and the infrastructure.
- Act honorably, honestly, justly, responsibly, and legally.
- Provide diligent and competent service to principals.
- Advance and protect the profession.
|
