CIPS L4M3 Exam With Confidence Using Practice Dumps

Information Assurance (IA)

Information Assurance (IA) is the practice of managing information-related risks and the steps involved to protect information systems such as computer and network systems. The IA transformation is a partnership that stretches across the Department of Defense (DoD), Office of National Intelligence, Committee on National Security Systems, National Institute of Science and Technology (NIST), and the Office of Management and Budget.

The US Government's definition of information assurance is:

“measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.”

Information Assurance (IA) is essentially protecting information systems, and is often associated with the following five pillars:

- Integrity

- Availability

- Authentication

- Confidentiality

- Nonrepudiation

The following pillars can be applied in a variety of ways, depending on the sensitivity of the information, or information systems within your organization. Currently, these five pillars are used at the heart of the US Governments ability to conduct safe and secure operations in a global environment.

1. Integrity

Integrity involves assurance that all information systems are protected and not tampered with. IA aims to maintain integrity through means such as anti-virus software on all computer system, and ensuring all staff with access to know how to appropriately use their systems to minimize malware, or viruses entering information systems.

2. Availability

Availability simply means those who need access to information, are allowed to access it. Information should be available to only those who are aware of the risks associated with information systems.

3. Authentication

Authentication involves ensuring those who have access to information, are who they say they are. Ways of improving authentication involve methods such as two-factor authentication, strong passwords, bio-metrics and other devices. Authentication may also be used to not only identify users, but also other devices.

4. Confidentiality

IA involves the confidentiality of information, meaning only those with authorization may view certain data. This step is closely mirrored by the six data processing principles of the General Data Protection Regulation (GDPR), where by personal data must be processed in a secure manner "using appropriate technical and organizational measures" ("integrity and confidentiality").

5. Nonrepudiation

The final pillar simply means someone with access to your organizations information system cannot deny having completed an action within the system, as there should be methods in place to prove that they did make said action.

Service level agreement often sets out the minimum quality standards of the services provided, remedies if that standards are not met, consequences if the targets are exceeded. Penalty clauses and service credits are remedies that are often used in conjunction with service level agreement to ensure the performance and to compensate the purchaser if targets are not met.

An indemnity is a promise by one party to compensate another for the loss suffered as a consequence of a specific event, called the ''trigger event''.

The trigger event can be anything defined by the parties, including:

- A breach of contract;

- A party's fault or negligence;

- A specific action.

An indemnity operates as a transfer of risks between the parties, and changes what they would otherwise be liable for or entitled to under a normal damage claim.

Force Majeure Provisions: A force majeure event refers to the occurrence of an event which is outside the reasonable control of a party and which prevents that party from performing its obligations under a contract.

Liquidated damages are presented in certain legal contracts as an estimate of otherwise intangible or hard-to-define losses to one of the parties. It is a provision that allows for the payment of a specified sum should one of the parties be in breach of contract.

LO 3, AC 3.2