A01 chaf6542 06 se fm indd

information 

asset register (IAR)

 be created, detailing every information asset within the organisation 

such as databases, personnel records, contracts, software licences, publicity material. For 

each asset, responsibility is defined. The value of each asset can then be determined to 

ensure appropriate security is in place.

● 

Section  4: Personnel security. This ensures there is clarity within job definitions and 

employment contracts, to reduce the risk of human error leading to information loss and 

to ensure that staff understand what their rights and responsibilities are concerning infor-

mation security. Staff training is also important to achieve this.

● 

Section 5: Physical and environmental security. This defines physical access to buildings. It 

also considers how information can be protected from threats such as fire and flood.

● 

Section 6: Communications and operations management. Guidelines on the day-to-day 

operation of information systems is the largest section of BS 7799. It covers acceptance 

criteria for new or updated systems, virus defence software, email and website usage, net-

work access and back-up and restore systems.

● 

Section  7: Access control. This defines how to protect access to information systems 

through access control mechanisms (username and password procedures with different 

security clearance for different applications and types of information).