5 Game.

gif Security policy

6 Game.gif Information security policy
7 Game.gif Information security policy document
8 Game.gif Review of the information security policy
9 Game.gif Organization of information security
10 Game.gif Internal Organization
11 Game.gif Management commitment to information security
12 Game.gif Information security coordination
13 Game.gif Allocation of information security responsibilities
14 Game.gif Authorization process for information processing facilities
15 Game.gif Confidentiality agreements
16 Game.gif Contact with authorities
17 Game.gif Contact with special interest groups
18 Game.gif Independent review of information security
Game.gif External Parties
Game.gif Identification of risks related to external parties
A.6.2.2 Addressing security when dealing with customers
A.6.2.3 Addressing security in third party agreements
A.7 Asset Management
A.7.1 Responsibility of Assets
A.7.1.1 Inventory of assets
A.7.1.2 Ownership of assets
A.7.1.3 Acceptable use of assets
A.7.2 Information Classification
A.7.2.1 Classification guidelines
A.7.2.2 Information labeling and handling
A.8 Human resource security
A.8.1 Prior to employment
A.8.1.1 Roles and responsibilities
A.8.1.2 Screening
A.8.1.3 Terms and conditions
A.8.2 During employment
A.8.2.1 Management responsibility
A.8.2.2 Information systems training education and awareness
A.8.2.3 Disciplinary Process
A.8.3 Termination or change of employment
A.8.3.1 Termination responsibilities
A.8.3.2 Return of assets
A.8.3.3 Removal of assess rights
A.9 Physical and environmental security
A.9.1 Secure areas
A.9.1.1 Physical security perimeter
A.9.1.2 Physical entry controls
A.9.1.3 Securing offices, rooms and facilities
A.9.1.4 Protection against external and environmental threats
A.9.1.5 Working in secure areas
A.9.1.6 Public access delivery and loading
A.9.2 Equipment Security
A.9.2.1 Equipment sitting and protection
A.9.2.2 support utilities
A.9.2.3 Cabling security
A.9.2.4 Equipment maintenance
A.9.2.5 Equipment in offsite premises
A.9.2.6 Secure disposal and reuse of equipment
A.9.2.7 Removal of property
A.10 Communication and operations management
A.10.1 Operating Procedure and responsibilities
A.10.1.1 Documented operating procedure
A.10.1.2 Change management
A.10.1.3 Segregation of duties
A.10.1.4 Separation of development test and operational facilities
A.10.2 Third Party service delivery management
A.10.2.1 Service delivery
A.10.2.2 Monitoring and review of third party services
A.10.2.3 Managing Changes to third party services
A.10.3 System planning and Acceptance
A.10.3.1 Capacity management
A.10.3.2 System Acceptance
A.10.4 Protection against malicious and mobile code
A.10.4.1 Controls against malicious code
A.10.4.2 Controls against mobile code
A.10.5 Back up
A.10.5.1 Information Back up
A.10.6 Network security management
A.10.6.1 Network controls
A.10.6.2 Securing Network Services
A.10.7 Media handling
A.10.7.1 Management of removable media
A.10.7.2 Disposal of media
A.10.7.3 Information handling procedures
A.10.7.4 Security in system documentation
A.10.8 Exchange of Information
A.10.8.1 Information exchange Policies Procedures
A.10.8.2 Exchange agreements
A.10.8.3 Physical media during transit
A.10.8.4 Electronic messaging service
A.10.9 Electronic Commerce service
A.10.9.1 Electronic commerce
A.10.9.2 Online transactions
A.10.9.3 Publically available information
A.10.9.4 Protection against external and environmental threats
A.10.10 Monitoring
A.10.10.1 Audit logging
A.10.10.2 Monitoring system use
A.10.10.3 Protection of log information
A.10.10.4 Administrator and operator log
A.10.10.5 Faulty Logging
A.10.10.6 Clock Synchronization
A.11 Access Control
A.11.1 Business Requirement for access Control
A.11.1.1 Access control policy
A.11.2 User access management
A.11.2.1 User registration
A.11.2.2 Privileged management
A.11.2.3 Password management
A.11.2.4 Review of access rights
A.11.3 User responsibilities
A.11.3.1 Password use
A.11.3.2 Unattended user equipment
A.11.3.3 Clear desk and clear screen policy
A.11.4 Network access control
A.11.4.1 Policy on use of network controls
A.11.4.2 User authentication for external connections
A.11.4.3 Equipment identification in networks
A.11.4.4 Remote diagnostic and configuration port protection
A.11.4.5 Segregation in networks
A.11.4.6 Network connection control
A.11.4.7 Network routing control
A.11.5 Operating system access control
A.11.5.1 Secure log on procedure
A.11.5.2 User identification and authentication
A.11.5.3 Password management system
A.11.5.4 Use of system utilities
A.11.5.5 Session time out
A.11.5.6 Limitation of connection time
A.11.6 Application and information access control
A.11.6.1 Information Access restriction
A.11.6.2 Sensitive system isolation
A.11.7 Mobile computing and teleworking
A.11.7.1 Mobile computing and communication
A.11.7.2 Teleworking
A.12 Information System Acquisition, Development and Maintenance
A.12.1 Security requirements
A.12.1.1 Security requirements analysis and specification
A.12.2 Correct processing in application
A.12.2.1 Input Data Validation
A.12.2.2 Control of internal processing
A.15.1.4 Data Protection and Privacy of personal information
A.12.2.4 Output data validation
A.12.3 Cryptographic controls
A.12.3.1 Policy on use of cryptographic controls
A.12.3.2 Key management
A.12.4 Security of system files
A.12.4.1 Control of operational Software
A.12.4.2 Protection of system test
A.12.4.3 Access control to program source code
A.12.5 Security in development and support process
A.12.5.1 Change Control Procedure
A.12.5.2 Technical Review of application after operating System changes
A.12.5.3 Restrictions on changes to software Packages
A.12.5.4 Information Leakage
A.12.5.5 Outsourced software development
A.12.6 Technical vulnerability management
A.12.6.1 Control of technical vulnerability
A.13 Information security Incident management
A.13.1 Reporting Information security events and weakness
A.13.1.1 Reporting Information security events
A.13.1.2 Reporting information security weakness
A.13.2 Management of information security incidents and improvements
A.13.2.1 Responsibilities and procedures
A.13.2.2 Learning from information security incidents
A.13.2.3 Collection of evidence
A.14 Business continuity management
A.14.1 Information security aspects of business continuity management
A.14.1.1 Including information security in the BCM Process
A.14.1.2 Business continuity and risk assessment
A.14.1.3 Developing and implementing continuity plan including information secur
A.14.1.4 BCP Framework
A.14.1.5 Testing maintaining and reassessing of BCP
A.15 Compliance
A.15.1 Compliance with legal requirements
A.15.1.1 Identification of Applicable legislations
A.15.1.2 Intellectual property rights (IPR)
A.15.1.3 Protection of organizational records
A.15.1.4 Data Protection and Privacy of personal information
A.15.1.5 Prevention and misuse of information processing facilities
A.15.1.6 Regulation of cryptographic controls
A.15.2 compliance with security policy and standards and technical compliance
A.15.2.1 Compliance with security Policy and standards
A.15.2.2 Technical compliance checking
A.15.3 Information system audit considerations
A.15.3.1 Information system audit controls
A.15.3.2 Protection of information systems audit tools
insert into game_gallery (comp_proc_desc) values ('Game.gif Security policy');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Information security policy ');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Information security policy document');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Review of the information security policy');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Organization of information security');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Internal Organization');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Management commitment to information security');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Information security coordination');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Allocation of information security responsibilities');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Authorization process for information processing facilities
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Confidentiality agreements');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Contact with authorities');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Contact with special interest groups');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Independent review of information security');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif External Parties');
insert into master_comp_proc (comp_proc_desc) values ('Game.gif Identification of risks related to external parties');
insert into master_comp_proc (comp_proc_desc) values ('A.6.2.2 Addressing security when dealing with customers');
insert into master_comp_proc (comp_proc_desc) values ('A.6.2.3 Addressing security in third party agreements');
insert into master_comp_proc (comp_proc_desc) values ('A.7 Asset Management');
insert into master_comp_proc (comp_proc_desc) values ('A.7.1 Responsibility of Assets');
insert into master_comp_proc (comp_proc_desc) values ('A.7.1.1 Inventory of assets');
insert into master_comp_proc (comp_proc_desc) values ('A.7.1.2 Ownership of assets');
insert into master_comp_proc (comp_proc_desc) values ('A.7.1.3 Acceptable use of assets');
insert into master_comp_proc (comp_proc_desc) values ('A.7.2 Information Classification');
insert into master_comp_proc (comp_proc_desc) values ('A.7.2.1 Classification guidelines');
insert into master_comp_proc (comp_proc_desc) values ('A.7.2.2 Information labeling and handling');
insert into master_comp_proc (comp_proc_desc) values ('A.8 Human resource security');
insert into master_comp_proc (comp_proc_desc) values ('A.8.1 Prior to employment');
insert into master_comp_proc (comp_proc_desc) values ('A.8.1.1 Roles and responsibilities');
insert into master_comp_proc (comp_proc_desc) values ('A.8.1.2 Screening');
insert into master_comp_proc (comp_proc_desc) values ('A.8.1.3 Terms and conditions');
insert into master_comp_proc (comp_proc_desc) values ('A.8.2 During employment');
insert into master_comp_proc (comp_proc_desc) values ('A.8.2.1 Management responsibility');
insert into master_comp_proc (comp_proc_desc) values ('A.8.2.2 Information systems training education and awareness');
insert into master_comp_proc (comp_proc_desc) values ('A.8.2.3 Disciplinary Process');
insert into master_comp_proc (comp_proc_desc) values ('A.8.3 Termination or change of employment');
insert into master_comp_proc (comp_proc_desc) values ('A.8.3.1 Termination responsibilities');
insert into master_comp_proc (comp_proc_desc) values ('A.8.3.2 Return of assets');
insert into master_comp_proc (comp_proc_desc) values ('A.8.3.3 Removal of assess rights');
insert into master_comp_proc (comp_proc_desc) values ('A.9 Physical and environmental security');
insert into master_comp_proc (comp_proc_desc) values ('A.9.1 Secure areas');
insert into master_comp_proc (comp_proc_desc) values ('A.9.1.1 Physical security perimeter');
insert into master_comp_proc (comp_proc_desc) values ('A.9.1.2 Physical entry controls');
insert into master_comp_proc (comp_proc_desc) values ('A.9.1.3 Securing offices, rooms and facilities');
insert into master_comp_proc (comp_proc_desc) values ('A.9.1.4 Protection against external and environmental threats');
insert into master_comp_proc (comp_proc_desc) values ('A.9.1.5 Working in secure areas');
insert into master_comp_proc (comp_proc_desc) values ('A.9.1.6 Public access delivery and loading');
insert into master_comp_proc (comp_proc_desc) values ('A.9.2 Equipment Security');
insert into master_comp_proc (comp_proc_desc) values ('A.9.2.1 Equipment sitting and protection');
insert into master_comp_proc (comp_proc_desc) values ('A.9.2.2 support utilities');
insert into master_comp_proc (comp_proc_desc) values ('A.9.2.3 Cabling security');
insert into master_comp_proc (comp_proc_desc) values ('A.9.2.4 Equipment maintenance');
insert into master_comp_proc (comp_proc_desc) values ('A.9.2.5 Equipment in offsite premises');
insert into master_comp_proc (comp_proc_desc) values ('A.9.2.6 Secure disposal and reuse of equipment');
insert into master_comp_proc (comp_proc_desc) values ('A.9.2.7 Removal of property');
insert into master_comp_proc (comp_proc_desc) values ('A.10 Communication and operations management');
insert into master_comp_proc (comp_proc_desc) values ('A.10.1 Operating Procedure and responsibilities');
insert into master_comp_proc (comp_proc_desc) values ('A.10.1.1 Documented operating procedure');
insert into master_comp_proc (comp_proc_desc) values ('A.10.1.2 Change management');
insert into master_comp_proc (comp_proc_desc) values ('A.10.1.3 Segregation of duties');
insert into master_comp_proc (comp_proc_desc) values ('A.10.1.4 Separation of development test and operational facilities')
insert into master_comp_proc (comp_proc_desc) values ('A.10.2 Third Party service delivery management');
insert into master_comp_proc (comp_proc_desc) values ('A.10.2.1 Service delivery');
insert into master_comp_proc (comp_proc_desc) values ('A.10.2.2 Monitoring and review of third party services');
insert into master_comp_proc (comp_proc_desc) values ('A.10.2.3 Managing Changes to third party services');
insert into master_comp_proc (comp_proc_desc) values ('A.10.3 System planning and Acceptance');
insert into master_comp_proc (comp_proc_desc) values ('A.10.3.1 Capacity management');
insert into master_comp_proc (comp_proc_desc) values ('A.10.3.2 System Acceptance');
insert into master_comp_proc (comp_proc_desc) values ('A.10.4 Protection against malicious and mobile code');
insert into master_comp_proc (comp_proc_desc) values ('A.10.4.1 Controls against malicious code');
insert into master_comp_proc (comp_proc_desc) values ('A.10.4.2 Controls against mobile code');
insert into master_comp_proc (comp_proc_desc) values ('A.10.5 Back up');
insert into master_comp_proc (comp_proc_desc) values ('A.10.5.1 Information Back up');
insert into master_comp_proc (comp_proc_desc) values ('A.10.6 Network security management');
insert into master_comp_proc (comp_proc_desc) values ('A.10.6.1 Network controls');
insert into master_comp_proc (comp_proc_desc) values ('A.10.6.2 Securing Network Services');
insert into master_comp_proc (comp_proc_desc) values ('A.10.7 Media handling');
insert into master_comp_proc (comp_proc_desc) values ('A.10.7.1 Management of removable media');
insert into master_comp_proc (comp_proc_desc) values ('A.10.7.2 Disposal of media');
insert into master_comp_proc (comp_proc_desc) values ('A.10.7.3 Information handling procedures');
insert into master_comp_proc (comp_proc_desc) values ('A.10.7.4 Security in system documentation');
insert into master_comp_proc (comp_proc_desc) values ('A.10.8 Exchange of Information');
insert into master_comp_proc (comp_proc_desc) values ('A.10.8.1 Information exchange Policies Procedures');
insert into master_comp_proc (comp_proc_desc) values ('A.10.8.2 Exchange agreements');
insert into master_comp_proc (comp_proc_desc) values ('A.10.8.3 Physical media during transit');
insert into master_comp_proc (comp_proc_desc) values ('A.10.8.4 Electronic messaging service');
insert into master_comp_proc (comp_proc_desc) values ('A.10.9 Electronic Commerce service');
insert into master_comp_proc (comp_proc_desc) values ('A.10.9.1 Electronic commerce');
insert into master_comp_proc (comp_proc_desc) values ('A.10.9.2 Online transactions');
insert into master_comp_proc (comp_proc_desc) values ('A.10.9.3 Publically available information');
insert into master_comp_proc (comp_proc_desc) values ('A.10.9.4 Protection against external and environmental threats');
insert into master_comp_proc (comp_proc_desc) values ('A.10.10 Monitoring');
insert into master_comp_proc (comp_proc_desc) values ('A.10.10.1 Audit logging');
insert into master_comp_proc (comp_proc_desc) values ('A.10.10.2 Monitoring system use');
insert into master_comp_proc (comp_proc_desc) values ('A.10.10.3 Protection of log information');
insert into master_comp_proc (comp_proc_desc) values ('A.10.10.4 Administrator and operator log');
insert into master_comp_proc (comp_proc_desc) values ('A.10.10.5 Faulty Logging');
insert into master_comp_proc (comp_proc_desc) values ('A.10.10.6 Clock Synchronization');
insert into master_comp_proc (comp_proc_desc) values ('A.11 Access Control');
insert into master_comp_proc (comp_proc_desc) values ('A.11.1 Business Requirement for access Control');
insert into master_comp_proc (comp_proc_desc) values ('A.11.1.1 Access control policy');
insert into master_comp_proc (comp_proc_desc) values ('A.11.2 User access management');
insert into master_comp_proc (comp_proc_desc) values ('A.11.2.1 User registration');
insert into master_comp_proc (comp_proc_desc) values ('A.11.2.2 Privileged management');
insert into master_comp_proc (comp_proc_desc) values ('A.11.2.3 Password management');
insert into master_comp_proc (comp_proc_desc) values ('A.11.2.4 Review of access rights');
insert into master_comp_proc (comp_proc_desc) values ('A.11.3 User responsibilities');
insert into master_comp_proc (comp_proc_desc) values ('A.11.3.1 Password use');
insert into master_comp_proc (comp_proc_desc) values ('A.11.3.2 Unattended user equipment');
insert into master_comp_proc (comp_proc_desc) values ('A.11.3.3 Clear desk and clear screen policy');
insert into master_comp_proc (comp_proc_desc) values ('A.11.4 Network access control');
insert into master_comp_proc (comp_proc_desc) values ('A.11.4.1 Policy on use of network controls');
insert into master_comp_proc (comp_proc_desc) values ('A.11.4.2 User authentication for external connections');
insert into master_comp_proc (comp_proc_desc) values ('A.11.4.3 Equipment identification in networks');
insert into master_comp_proc (comp_proc_desc) values ('A.11.4.4 Remote diagnostic and configuration port protection');
insert into master_comp_proc (comp_proc_desc) values ('A.11.4.5 Segregation in networks');
insert into master_comp_proc (comp_proc_desc) values ('A.11.4.6 Network connection control');
insert into master_comp_proc (comp_proc_desc) values ('A.11.4.7 Network routing control');
insert into master_comp_proc (comp_proc_desc) values ('A.11.5 Operating system access control');
insert into master_comp_proc (comp_proc_desc) values ('A.11.5.1 Secure log on procedure');
insert into master_comp_proc (comp_proc_desc) values ('A.11.5.2 User identification and authentication');
insert into master_comp_proc (comp_proc_desc) values ('A.11.5.3 Password management system');
insert into master_comp_proc (comp_proc_desc) values ('A.11.5.4 Use of system utilities');
insert into master_comp_proc (comp_proc_desc) values ('A.11.5.5 Session time out');
insert into master_comp_proc (comp_proc_desc) values ('A.11.5.6 Limitation of connection time');
insert into master_comp_proc (comp_proc_desc) values ('A.11.6 Application and information access control');
insert into master_comp_proc (comp_proc_desc) values ('A.11.6.1 Information Access restriction');
insert into master_comp_proc (comp_proc_desc) values ('A.11.6.2 Sensitive system isolation');
insert into master_comp_proc (comp_proc_desc) values ('A.11.7 Mobile computing and teleworking');
insert into master_comp_proc (comp_proc_desc) values ('A.11.7.1 Mobile computing and communication');
insert into master_comp_proc (comp_proc_desc) values ('A.11.7.2 Teleworking');
insert into master_comp_proc (comp_proc_desc) values ('A.12 Information System Acquisition, Development and Maintenan
insert into master_comp_proc (comp_proc_desc) values ('A.12.1 Security requirements');
insert into master_comp_proc (comp_proc_desc) values ('A.12.1.1 Security requirements analysis and specification');
insert into master_comp_proc (comp_proc_desc) values ('A.12.2 Correct processing in application');
insert into master_comp_proc (comp_proc_desc) values ('A.12.2.1 Input Data Validation');
insert into master_comp_proc (comp_proc_desc) values ('A.12.2.2 Control of internal processing');
insert into master_comp_proc (comp_proc_desc) values ('A.15.1.4 Data Protection and Privacy of personal information');
insert into master_comp_proc (comp_proc_desc) values ('A.12.2.4 Output data validation');
insert into master_comp_proc (comp_proc_desc) values ('A.12.3 Cryptographic controls');
insert into master_comp_proc (comp_proc_desc) values ('A.12.3.1 Policy on use of cryptographic controls');
insert into master_comp_proc (comp_proc_desc) values ('A.12.3.2 Key management');
insert into master_comp_proc (comp_proc_desc) values ('A.12.4 Security of system files');
insert into master_comp_proc (comp_proc_desc) values ('A.12.4.1 Control of operational Software');
insert into master_comp_proc (comp_proc_desc) values ('A.12.4.2 Protection of system test');
insert into master_comp_proc (comp_proc_desc) values ('A.12.4.3 Access control to program source code');
insert into master_comp_proc (comp_proc_desc) values ('A.12.5 Security in development and support process');
insert into master_comp_proc (comp_proc_desc) values ('A.12.5.1 Change Control Procedure');
insert into master_comp_proc (comp_proc_desc) values ('A.12.5.2 Technical Review of application after operating System ch
insert into master_comp_proc (comp_proc_desc) values ('A.12.5.3 Restrictions on changes to software Packages');
insert into master_comp_proc (comp_proc_desc) values ('A.12.5.4 Information Leakage');
insert into master_comp_proc (comp_proc_desc) values ('A.12.5.5 Outsourced software development');
insert into master_comp_proc (comp_proc_desc) values ('A.12.6 Technical vulnerability management');
insert into master_comp_proc (comp_proc_desc) values ('A.12.6.1 Control of technical vulnerability');
insert into master_comp_proc (comp_proc_desc) values ('A.13 Information security Incident management');
insert into master_comp_proc (comp_proc_desc) values ('A.13.1 Reporting Information security events and weakness');
insert into master_comp_proc (comp_proc_desc) values ('A.13.1.1 Reporting Information security events');
insert into master_comp_proc (comp_proc_desc) values ('A.13.1.2 Reporting information security weakness');
insert into master_comp_proc (comp_proc_desc) values ('A.13.2 Management of information security incidents and improve
insert into master_comp_proc (comp_proc_desc) values ('A.13.2.1 Responsibilities and procedures ');
insert into master_comp_proc (comp_proc_desc) values ('A.13.2.2 Learning from information security incidents');
insert into master_comp_proc (comp_proc_desc) values ('A.13.2.3 Collection of evidence');
insert into master_comp_proc (comp_proc_desc) values ('A.14 Business continuity management');
insert into master_comp_proc (comp_proc_desc) values ('A.14.1 Information security aspects of business continuity managem
insert into master_comp_proc (comp_proc_desc) values ('A.14.1.1 Including information security in the BCM Process');
insert into master_comp_proc (comp_proc_desc) values ('A.14.1.2 Business continuity and risk assessment');
insert into master_comp_proc (comp_proc_desc) values ('A.14.1.3 Developing and implementing continuity plan including in
insert into master_comp_proc (comp_proc_desc) values ('A.14.1.4 BCP Framework');
insert into master_comp_proc (comp_proc_desc) values ('A.14.1.5 Testing maintaining and reassessing of BCP');
insert into master_comp_proc (comp_proc_desc) values ('A.15 Compliance');
insert into master_comp_proc (comp_proc_desc) values ('A.15.1 Compliance with legal requirements');
insert into master_comp_proc (comp_proc_desc) values ('A.15.1.1 Identification of Applicable legislations');
insert into master_comp_proc (comp_proc_desc) values ('A.15.1.2 Intellectual property rights (IPR)');
insert into master_comp_proc (comp_proc_desc) values ('A.15.1.3 Protection of organizational records');
insert into master_comp_proc (comp_proc_desc) values ('A.15.1.4 Data Protection and Privacy of personal information');
insert into master_comp_proc (comp_proc_desc) values ('A.15.1.5 Prevention and misuse of information processing facilities
insert into master_comp_proc (comp_proc_desc) values ('A.15.1.6 Regulation of cryptographic controls');
insert into master_comp_proc (comp_proc_desc) values ('A.15.2 compliance with security policy and standards and technical
insert into master_comp_proc (comp_proc_desc) values ('A.15.2.1 Compliance with security Policy and standards');
insert into master_comp_proc (comp_proc_desc) values ('A.15.2.2 Technical compliance checking');
insert into master_comp_proc (comp_proc_desc) values ('A.15.3 Information system audit considerations');
insert into master_comp_proc (comp_proc_desc) values ('A.15.3.1 Information system audit controls');
insert into master_comp_proc (comp_proc_desc) values ('A.15.3.2 Protection of information systems audit tools');
ation security');
Normal
Abnormal
Emergency
Legal requirement
Interested party concern
insert into master_comp_proc (comp_proc_desc) values ('Normal');
insert into master_comp_proc (comp_proc_desc) values ('Abnormal');
insert into master_comp_proc (comp_proc_desc) values ('Emergency');
insert into master_comp_proc (comp_proc_desc) values ('Legal requirement');
insert into master_comp_proc (comp_proc_desc) values ('Interested party concern');