IT Security Training and Information Systems Lifecycle Management
This paper examines long-term planning for information systems security, with a focus on two interconnected areas. Part 1 outlines a comprehensive IT security training plan for an organization, covering awareness programs, short-term vendor certifications such as CCNA and MCSE, and long-term credentials through GIAC programs offered by the SANS Institute. Part 2 addresses Information Systems Security Lifecycle Management (ISSLM), analyzing its key benefits—including consistency, inclusiveness, and flexibility—alongside common disadvantages stemming from inadequate Information Assurance planning during system development. Together, the two sections argue that a layered approach to security education and lifecycle management is essential for protecting organizational information assets.
- Introduction to Information Security Planning: Defines information security and outlines core policy components
- IT Security Training Plan: Tiered training model for employees by role
- Awareness Programs and Certification Pathways: Awareness programs, vendor certs, and GIAC credentials
- Information Systems Security Lifecycle Management: Introduces ISSLM and current management gaps
- Benefits and Disadvantages of ISSLM: Evaluates strengths and weaknesses of lifecycle management
- Conclusion: Summary of security planning and staff awareness goals
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- Clearly organizes a multi-part security plan into discrete, logically sequenced sections, making the argument easy to follow from awareness through advanced certification.
- Draws on credible industry sources such as NIST publications and recognized certification bodies (SANS Institute, Cisco, Microsoft) to support its recommendations.
- Balances practical short-term recommendations (vendor certifications) with strategic long-term goals (GIAC credentials), demonstrating awareness of organizational development timelines.
Key academic technique demonstrated
The paper demonstrates applied policy analysis: it takes a real organizational context and maps abstract security principles onto concrete, actionable recommendations. By distinguishing between awareness, training, and certification as separate but complementary layers, it shows the ability to decompose a complex problem into manageable components—a skill central to information systems and business writing.
Structure breakdown
The paper is divided into two parts. Part 1 opens with a definition of information security and a network security policy checklist, then moves through a tiered training plan, an awareness program rationale, and short- and long-term certification recommendations. Part 2 shifts to Information Systems Security Lifecycle Management, introducing the concept, then evaluating its benefits and disadvantages before a brief conclusion. Each section builds on the previous one, creating a coherent progression from individual training to enterprise-level lifecycle governance.
Introduction to Information Security Planning
Information security means defending information and information systems from unlawful access, use, disclosure, disruption, alteration, inspection, assessment, recording, or damage. In order to be successful, every organization needs to have a written network security plan in place. A thorough policy will cover topics such as:
- Acceptable use policy — to state what kinds of network activities are permissible and which are forbidden
- Email and communications policy — to help reduce problems arising from emails and attachments
- Antivirus policy — to help guard the network against threats such as viruses, worms, and Trojan horses
- Identity policy — to help defend the network from unauthorized users
- Password policy — to help employees select strong passwords and protect them
- Encryption policy — to provide guidance on using encryption technology to protect network data
- Remote access policy — to help employees safely access the network when working outside the office (Security Network Checklist, n.d.)
IT Security Training Plan
An organization cannot safeguard the integrity, privacy, and accessibility of information in today's highly networked environment without ensuring that every person involved in the process understands their roles and responsibilities and is sufficiently trained to perform them. Going forward, training will be carried out for current employees; for new employees within sixty days of hire; whenever there is a major change in the IT security environment or procedures; when an employee enters a new position that deals with sensitive information; and periodically as refresher training, based on the sensitivity of the information the employee handles (Information Technology Security Training Requirements: A Role- and Performance-Based Model, n.d.).
Everyone needs basic training in IT security concepts and practices. Beyond the basics, this approach establishes three separate levels of IT security training: Beginning, Intermediate, and Advanced. Each level is then associated with specific roles and responsibilities. Because people often perform more than one role within an organization, they may need intermediate or advanced IT security training in their primary job role but only beginning-level training in a secondary or tertiary role. This model makes it possible to tailor training to individual employee needs and career mobility, as well as to an organization's evolving mission and changing mix of job functions. Ultimately, the concept of refresher training — traditionally viewed as repetitive learning — gives way to a just-in-time learning approach as an individual's or organization's IT security training needs evolve (Information Technology Security Training Requirements: A Role- and Performance-Based Model, n.d.).
Create your account
Always verify citation format against your institution’s current style guide requirements.