1. What do data breach notification laws require? Why has this caused companies to think more about security?

300 words

Residency Project 3 – Governance and Strategic Planning for Security

Strategic planning and corporate responsibility are best accomplished using an approach industry refers to as governance, risk management, and compliance (GRC). GRC seeks to integrate these three, previously separate responsibilities into one holistic approach that can provide sound executive-level strategic planning and management of the InfoSec function.

Governance is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly.

Strategic planning is the process of defining and specifying the long-term direction (strategy) to be taken by an organization, and the allocation and acquisition of resources needed to pursue this effort.

For this project, using https://www.sciencedirect.com/topics/computer-science/security-governanceLinks to an external site. and https://securityintelligence.com/the-importance-of-building-an-information-security-strategic-plan/Links to an external site. , prepare a 2-3 page paper (not counting your title page and references page) that addresses the following:

(a) Indicate in detail, what is InfoSec Governance?

(b) Indicate in detail, what is the importance of building an information security strategic plan?

primary task 500 words  

Within the Discussion Board area, write 400–600 words that respond to the following questions with your thoughts, ideas, and comments. This will be the foundation for future discussions by your classmates. Be substantive and clear, and use examples to reinforce your ideas:

A risk cube is a tool that is used to analyze a security risk issue. For example, consider the challenge to measure security concerns for a direct-recording electronic (DRE) voting machine. The risk cube has the following domains:

• Probability: Likelihood of error (low, medium, high)
• Outcome: Severity of error (low, high)
• Duration: Impact of error (isolated, long-term)

Use the risk cube as the tool to categorize the security risks, and justify the DRE acceptance or rejection in each subcube. Complete the following:

• For each subcube, justify the acceptance or rejection of DRE voting with a summarized statement.
  • In addition to the acceptance or rejection choice, add a security risk classification of high, medium, or low for each subcube.
• Conclude with a statement of expected concurrency with the risk cubes of peers.
  • If a single risk cube were to be created from those of all peers, would significant differences be expected?
  • What mitigation processes might be used to resolve differences?

MAIN PROJECT  ( NEED 3-4 PAGES)

Continue development of the Comprehensive Security Management Plan by adding a section reviewing the security policy. Create a list of each section in the security policy. Some sections in the list are business security requirements that can be decomposed first to more refined requirements and later to detailed security policies in the Security Policy document. This decomposition should be included in the list. These detailed policies do not need to be written, but referenced or indicated as a policy that needs to be written.

The project deliverables are the following:

• Update the Comprehensive Security Management Plan document title page with new date.
• Update the previously completed sections based on the instructor’s feedback.
• Use the subheading “Security Policy.”
  • List each section of the security policy.
    • Include decompositions of business security requirements into policies in this list.
      • For example, a business security requirement for authenticated access might map to policies for log-in access and policies for file access.
• Be sure to update your table of contents before submission.
• Name the document “yourname_CS654_IP3.doc.”

Review the “Chapter Twelve Case: Five Famous ERP Failures” at the end of Ch. 12 of Business Driven Technology.

Chapter Twelve Case: Five Famous ERP Failures

The world of ERP may seem boring to those caught up in the hysteria over Twitter and iPhone applications, but there’s plenty of drama to be found: Troubled multimillion-dollar software deals that produce spectacular failures and huge spending nightmares; vendor marketing bravado that breeds cut-throat competition and contempt; and embarrassing and costly lawsuits over botched implementations and intellectual property breaches. Consider CIO.com’s brief and semi-chronological history of five ERP scandals as a warning if you’re contemplating an upgrade or implementation.

1. Definitely Not a Sweet Experience for Hershey- Could a failed technology implementation take down a Fortune 500 company (in this case Hershey Foods)? Well, it certainly didn’t help Hershey’s operations during the Halloween season in 1999 or make Wall Street investors thrilled. In the end, Hershey’s ghastly problems with its SAP ERP, Siebel CRM and Manugistics supply chain applications prevented it from delivering $100 million worth of Kisses for Halloween that year and caused the stock to dip 8 percent. So I guess a failed technology project can’t actually take down a Fortune 500 company for good, but it can certainly knock it around a bit.
2. Just Do It: Fix Our Supply Chain System- What did a $400 million upgrade to Nike’s supply chain and ERP systems get the world-renowned shoe- and athletic gear-maker? Well, for starters, $100 millionin lost sales, a 20 percent stock dip and a collection of class-action lawsuits. This was all back in 2000, and the horrendous results were due to a bold ERP, supply chain and CRM project that aimed to upgrade the systems into one superstar system. Nike’s tale is both of woe and warning.
3. HP’s “Perfect Storm” of ERP Problems- The epic tale of HP’s centralization of its disparate North American ERP systems onto one SAP system proves that one can never be too pessimistic when it comes to ERP project management. You see, in 2004, HP’s project managers knew all of the things that could go wrong with their ERP rollout. But they just didn’t plan for so many of them to happen at once. The project eventually cost HP $160 million in order backlogs and lost revenue—more than five times the project’s estimated cost. Said Gilles Bouchard, then-CIO of HP’s global operations: “We had a series of small problems, none of which individually would have been too much to handle. But together they created the perfect storm.”
4. A New Type of Freshman Hazing- Pity the college freshman at the University of Massachusetts in fall 2004: The last thing they needed was some computer program to haunt their lives and make their new collegiate experience even more uncertain. But more than 27,000 students at the University of Massachusetts as well as Stanford and Indiana University were forced to do battle with buggy portals and ERP applications that left them at best unable to find their classes and at worst unable to collect their financial aid checks. Said one UMass senior at the time: “The freshmen were going crazy because they didn’t know where to go.” After a couple of tense days and weeks, however, everyone eventually got their checks and class schedules.
5. page 223Waste Management Trashes Its “Fake” ERP Software- Garbage-disposal giant Waste Management is still embroiled in an acrimonious $100 million legal battle with SAP over an 18-month installation of its ERP software. The initial deal began in 2005, but the legal saga commenced in March 2008, when Waste Management filed suit and claimed SAP executives participated in a fraudulent sales scheme that resulted in the massive failure. Several months later, SAP fired back, claiming that Waste Management allegedly violated its contractual agreement with SAP in several ways, including by “failing to timely and accurately define its business requirements,” and not providing “sufficient, knowledgeable, decision-empowered users and managers” to work on the project. In the fall 2008, accusations were still flying about documentation, depositions and delays in bringing the case before a judge. And that proposed 18-month implementation now sounds like a dream scenario.1

Review each of the five examples mentioned in the case. Use the company you currently work for or a company you have worked for answer the following questions:

• What is the benefit of integrating SCM, CRM, and ERP in an organization? How will it help?
• Why would an organization need to integrate an ERP?
• What advice would you provide a company that is trying to decide if implementing an ERP is right for their organization?

Respond to at least three of your peers. In your response, address any thoughts you have on the benefits of ERP process and the value of integrating SCM, CRM, and ERP within an organization.

Students need to contribute three substantive posts in this discussion by the due date indicated. The substantive posts can be any combination of responses and replies.

Peer 1

The only organization I have worked for that used an ERP was a large urban school district in human resources and professional development. We used the SAP ERP. As far as I know, we did not use a CRM or SCM. Every piece of our employee data was entered into the system upon hire. Our different departments had their own permissions as far as the parts of the data they were able to see and work with. Human resources had several different departments under the HR umbrella: certificated staffing (teachers/principals), non-certificated staffing (clerical, IT, maintenance, etc.), certification (qualifying teacher candidates), and each area had its own permissions. The benefit was the centralized employee information database, so that each department was using the same raw data to perform whatever work they needed to do. There were no data redundancies.

Because we were such a large school district, it was important that everyone had access to the data they needed to complete their work. If each department worked with their own databases, it would increase the likelihood of errors or duplicate data. Reports could be selected from specific templates or you could run an ad hoc query and add your own parameters (ex: math teachers with a master’s degree hired in a certain month.

I think companies should determine which ERP most closely matches the needs of the business. A huge company might choose a big ERP system while a smaller company could try out a trial period in ERP in the cloud to see if it is worth the price for their company. They should have in-depth conversations with a vendor consultant to determine price of the software and per user and make sure their product meets their needs. A requirements meeting would go into detail about what the business is trying to accomplish and what the software will be able to deliver. Keeping employees in the loop and considering their input as part of the process will lead to greater employee buy-in. 

Peer 2

Benefits of integrating SCM, CRM and ERP?

First and foremost, all your data is in one location which gives you a 360-degree view of your customers data. This also helps streamline all your business processes, as well as helps manage access to the software. This allows your limit access to our employee who needs the access.

Why would you integrate ERP?

ERP also known a core system allows a company to automate / manage the company and business processes. The processes of automating simple small tasks allows your employees to be freed up to focus on customers are more important tasks for your company such as expanding the company’s business.

Advice for implementing an ERP?

Do an RFI on all the top Vendors to decide which vendor is the best choice for your company.

Plan for expanding, do not select software that will not still fit you 5, 10 even 15 years down the road.

Make sure the vendor provides training.

Make sure the data, testing and functionality is all there that the vendor says is there.

Make sure it fits with the business plan and initiatives

Reference:

Baltzan, Paige. BUSINESS DRIVEN TECHNOLOGY, 7th Edition. McGraw-Hill Higher Education, 20170207.

Peer 3

Hello everyone!

• What is the benefit of integrating SCM, CRM, and ERP in an organization? How will it help

They are the backbone of ebusiness integration, success comes by integration of all these three. it allows the unlcokin of information to make it available anytime, any where and any user.

• Why would an organization need to integrate an ERP?

Because ERP is a full functionality with high performance that meets all business needs, and user requirements and it focuses on accessiblity, ubiquity, usaablity, mobility driving many advanages and its cost efficient, faster time to market, enables mobile workforce, new product development

• What advice would you provide a company that is trying to decide if implementing an ERP is right for their organization?

Make sure your company is ready to intergrate. Entail careful planning in order to minimize the risk of failure and ensure goals are met. And you need to understand what your business process are. The ERP requires standardize implementation blueprints it takes involvement of all business and IT staff to process.

Reference: Business Driven Technology, by Paige Baltzan, Chapter 12 Integrating the Organization from End to End Enterprise Planning,

https://phoenix.vitalsource.com/#/books/9781259852275/cfi/6/54!/4/2/2/2@0:0