SUBJECT MIS&ERP. Prepared By. B.G.N Saroj

Transcription

1 SUBJECT MIS&ERP Prepared By B.G.N Sarj

2 Management Infrmatin system and &ERP UNIT-1 Imprtance Of MIS Management Infrmatin Systems (MIS) nt nly include sftware systems, but the entire set f business prcesses and resurces that are used t pull tgether infrmatin frm functinal r tactical systems. Data is then presented in a user-friendly and timely manner s that mid and upper-level managers can use it t take the right actins. The entire system is designed s that the cmpany will meet its strategic and tactical gals. Significance Organizatins have multiple functinal systems. These usually include sales systems, call center systems, financial systems, inventry systems, lgistic systems and mre. MIS cmbines infrmatin frm multiple systems. This helps management staffers better understand their wn departments' cntributins. In many cases, the cmbinatin f data, such as sales figures cmbined with available inventry, help the manager take the apprpriate actin in rder t meet the custmer's needs. Functin The primary functin f MIS is t help a manager take an actin, answer a questin r ask the right questin. The questins r actins shuld directly relate t tactical r strategic gals. A sales manager wh uses prjectins frm the financial systems t cmpare with actual sales frm the sales system can better gauge whether gals will be met. If the target is nt ging t be met, then the manager and his grup can review their past actins and make necessary changes in rder t increase sales and meet gals. Types MIS is nt necessarily a specific cmbinatin f functinal systems, but instead is created based upn the business need. CRM (Custmer Relatinship Management) systems cmbine data that relates directly t the custmer experience. ERP (Enterprise Resurce Systems) cmbine data used in the entire sales prcess. Decisin Supprt Systems r Data Warehuse ften cmbine summary data frm multiple systems in rder t shw executives a snapsht view f the entire rganizatin. Cnsideratins Prir t starting an MIS prject, rganizatins need t carefully review the transactinal systems, the business prcesses and the needs f management within an rganizatin. As an MIS prject grws, s des the cst f implementing a slutin, managing the infrmatin prcesses and mnitring daily activities. The result f an MIS prject must prvide value back t the rganizatin in rder t be wrth the cst.

3 Miscnceptins Many managers mistakenly believe that, fr MIS t be effective, all data frm all systems must be cmbined. The value f MIS is based upn hw much it can help managers manage. If this means bringing just the data needed frm several systems and ignring the rest fr nw, the end result still has wrth, which is the ultimate gal f MIS. Defnitins f MIS An rganized apprach t the study f the infrmatin needs f an rganizatin's management at every level in making peratinal, tactical, and strategic decisins. Its bjective is t design and implement prcedures, prcesses, and rutines that prvide suitably detailed reprts in an accurate, cnsistent, and timely manner. In a management infrmatin system, mdern, cmputerized systems cntinuusly gather relevant data, bth frm inside and utside an rganizatin. This data is then prcessed, integrated, and stred in a centralized database (r data warehuse) where it is cnstantly updated and made available t all wh have the authrity t access it, in a frm that suits their purpse. Nature and scpe f MIS It shuld be based n a lng-term planning. It shuld prvide a hlistic view f the dynamics and the structure f the rganizatin. It shuld wrk as a cmplete and cmprehensive system cvering all intercnnecting sub-systems within the rganizatin. It shuld be planned in a tp-dwn way, as the decisin makers r the management shuld actively take part and prvide clear directin at the develpment stage f the MIS. It shuld be based n need f strategic, peratinal and tactical infrmatin f managers f an rganizatin. It shuld als take care f exceptinal situatins by reprting such situatins. It shuld be able t make frecasts and estimates, and generate advanced infrmatin, thus prviding a cmpetitive advantage. Decisin makers can take actins n the basis f such predictins. It shuld create linkage between all sub-systems within the rganizatin, s that the decisin makers can take the right decisin based n an integrated view.

4 It shuld allw easy flw f infrmatin thrugh varius sub-systems, thus aviding redundancy and duplicity f data. It shuld simplify the peratins with as much practicability as pssible. Althugh the MIS is an integrated, cmplete system, it shuld be made in such a flexible way that it culd be easily split int smaller sub-systems as and when required. A central database is the backbne f a well-built MIS. Characteristics f Cmputerized MIS Fllwing are the characteristics f a well-designed cmputerized MIS: It shuld be able t prcess data accurately and with high speed, using varius techniques like peratins research, simulatin, heuristics, etc. It shuld be able t cllect, rganize, manipulate, and update large amunt f raw data f bth related and unrelated nature, cming frm varius internal and external surces at different perids f time. It shuld prvide real time infrmatin n nging events withut any delay. It shuld supprt varius utput frmats and fllw latest rules and regulatins in practice. It shuld prvide rganized and relevant infrmatin fr all levels f management: strategic, peratinal, and tactical. It shuld aim at extreme flexibility in data strage and retrieval. Structure and classificatin f MIS The discipline f MIS can be categrized in the fllwing 6 classes: i) Transactin Prcessing System (TPS) ii) Management Infrmatin System (MIS) iii) Decisin Supprt System (DSS) iv) Executive Supprt System (ESS) v) Office Autmatin Systems (OASs), and vi) Business Expert Systems (BESs) Transactin Prcessing System TPS prcesses transactin and prduces reprts. It represents the autmatin f the fundamental, rutine prcessing used t supprt business peratins. It des nt prvide any infrmatin t

5 the user t his/her decisin-making. TPS uses data and prduces data as shwn in the fllwing diagram. Previusly, TPS was knwn as Management Infrmatin System. Prir t cmputers, data prcessing was perfrmed manually r with simple machines. The dmain f TPS is at the lwest level f the management hierarchy f an rganizatin. Management Infrmatin System (MIS) MIS is an infrmatin system, which prcesses data and cnverts it int infrmatin. A management infrmatin system uses TPS fr its data inputs. The infrmatin generated by the infrmatin system may be used fr cntrl f peratins, strategic and lng-range planning. Shrt-range planning, management cntrl, and ther managerial prblem slving. It encmpasses prcessing in supprt f a wide range f rganizatinal functins & management prcesses. MIS is capable f prviding analysis, planning & decisin making supprt. The functinal areas f a business may be marketing, prductin, human resurce, finance and accunting. Decisin Supprt System (DSS) A decisin supprt system (DSS) is an infrmatin system applicatin that assists decisinmaking. DSS tends t be used in planning, analyzing alternatives, and trial and errr search fr slutin. The elements f the decisin supprt system include a database, mdel base & sftware. The main applicatin areas f DSS are Prductin, finance and marketing.

6 Executive Supprt System (ESS) Executive Supprt System (ESS) is an extensin f the management infrmatin system, which is a special kind f DSS; An ESS is specially tailred fr the use f chief executive f an rganizatin t supprt his decisin-making. It includes varius types f decisin-making but it is mre specific and persn riented. Office Autmatin Systems (OAS) Office autmatin refers t the applicatin f cmputes and cmmunicatin technlgy t ffice functins. Office autmatin systems are meant t imprve the prductivity f managers at varius levels f management f prviding secretarial assistance and better cmmunicatin facilities. Office activities may be gruped under tw classes, namely i) Activities perfrmed by clerical persnnel (clerks, secretaries, typist, etc.,) and ii) Activities perfrmed by the executives (managers, engineers r ther prfessinals like ecnmist, researches etc.) The fllwing is a list f activities in the secnd categry (managerial categry) a) Cnferencing. b) Prductin f infrmatin (messages, mems, reprts, etc.) and cntrlling perfrmance Business Expert Systems: These systems are ne f the main types f knwledge-based infrmatin systems. These systems are based n artificial intelligence, and are advanced infrmatin systems. A business expert system is a knwledge based infrmatin system that uses its knwledge abut a specific, cmplex applicatin area t act as an expert. The main cmpnents f an expert system are:

7 a. Knwledge Base b. Interface Engine c. User Interface Types f Infrmatin Why are there different types f Infrmatin System? In the early days f cmputing, each time an infrmatin system was needed it was 'tailr made' - built as a ne-ff slutin fr a particular prblem. Hwever, it sn became apparent that many f the prblems infrmatin systems set ut t slve shared certain characteristics. Cnsequently, peple attempted t try t build a single system that wuld slve a whle range f similar prblems. Hwever, they sn realized that in rder t d this, it was first necessary t be able t define hw and where the infrmatin system wuld be used and why it was needed. It was then that the search fr a way t classify infrmatin systems accurately began. Hw d yu identify the different types f infrmatin system in an rganizatin? The different types f infrmatin system that can be fund are identified thrugh a prcess f classificatin. Classificatin is simply a methd by which things can be categrized r classified tgether s that they can be treated as if they were a single unit. There is a lng histry f classificatin f things in the natural wrld such as plants r animals, hwever, Infrmatin systems are nt part f the 'natural' wrld; they are created and acquired by man t deal with particular tasks and prblems. The classificatin f infrmatin systems int different types is a useful technique fr designing systems and discussing their applicatin; it nt hwever a fixed definitin

8 gverned by sme natural law. A 'type' r categry f infrmatin system is simply a cncept, an abstractin, which has been created as a way t simplify a cmplex prblem thrugh identifying areas f cmmnality between different things. One f the ldest and mst widely used systems fr classifying infrmatin systems is knwn as the pyramid mdel; this is described in mre detail belw. Hw many different kinds f Infrmatin System are there? As can be seen abve, there is nt a simple answer t this. Depending n hw yu create yur classificatin, yu can find almst any number f different types f infrmatin system. Hwever, it is imprtant t remember that different kinds f systems fund in rganizatins exist t deal with the particular prblems and tasks that are fund in rganizatins. Cnsequently, mst attempts t classify Infrmatin systems int different types rely n the way in which task and respnsibilities are divided within an rganizatin. As mst rganizatins are hierarchical, the way in which the different classes f infrmatin systems are categrized tends t fllw the hierarchy. This is ften described as "the pyramid mdel" because the way in which the systems are arranged mirrrs the nature f the tasks fund at varius different levels in the rganizatin. Fr example, this is a three level pyramid mdel based n the type f decisins taken at different levels in the rganizatin.

9 Three level pyramid mdel based n the type f decisins taken at different levels in the rganizatin Similarly, by changing ur criteria t the differnt types f date / infrmatin / knwledge that are prcessed at different levels in the rganizatin, we can create a five level mdel. Five level pyramid mdel based n the prcessing requirement f different levels in the rganizatin What are the mst cmmn types f infrmatin system in an rganizatin? While there are several different versins f the pyramid mdel, the mst cmmn is prbably a fur level mdel based n the peple wh use the systems. Basing the classificatin n the peple wh use the infrmatin system means that many f the ther characteristics such as the nature f the task and infrmatinal requirements, are taken int accunt mre r less autmatically.

10 Fur level pyramid mdel based n the different levels f hierarchy in the rganizatin A cmparisn f different kinds f Infrmatin Systems Using the fur level pyramid mdel abve, we can nw cmpare hw the infrmatin systems in ur mdel differ frm each ther. 1. Transactin Prcessing Systems What is a Transactin Prcessing System? Transactin Prcessing System are peratinal-level systems at the bttm f the pyramid. They are usually perated directly by shp flr wrkers r frnt line staff, which prvide the key data required t supprt the management f peratins. This data is usually btained thrugh the autmated r semiautmated tracking f lw-level activities and basic transactins. Functins f a TPS TPS are ultimately little mre than simple data prcessing systems.

11 Functins f a TPS in terms f data prcessing requirements Inputs Prcessing Outputs Transactins Events Validatin Srting Listing Merging Updating Calculatin Lists Detail reprts Actin reprts Summary reprts? Sme examples f TPS Payrll systems Order prcessing systems Reservatin systems Stck cntrl systems Systems fr payments and funds transfers The rle f TPS Prduce infrmatin fr ther systems Crss bundaries (internal and external) Used by peratinal persnnel + supervisry levels Efficiency riented 2. Management Infrmatin Systems What is a Management Infrmatin System? Fr histrical reasns, many f the different types f Infrmatin Systems fund in cmmercial rganizatins are referred t as "Management Infrmatin Systems". Hwever, within ur pyramid mdel, Management Infrmatin Systems are management-level systems that are used by middle managers t help ensure the smth running f the rganizatin in the shrt t medium term. The highly structured infrmatin prvided by these systems allws managers t evaluate an rganizatin's perfrmance by cmparing current with previus utputs.

12 Functins f a MIS MIS are built n the data prvided by the TPS Functins f a MIS in terms f data prcessing requirements Inputs Prcessing Outputs Internal Transactins Internal Files Structured data Srting Merging Summarizing Summary reprts Actin reprts Detailed reprts Sme examples f MIS Sales management systems Inventry cntrl systems Budgeting systems Management Reprting Systems (MRS) Persnnel (HRM) systems The rle f MIS Based n internal infrmatin flws Supprt relatively structured decisins Inflexible and have little analytical capacity Used by lwer and middle managerial levels Deals with the past and present rather than the future Efficiency riented? 3. Decisin Supprt Systems What is a Decisin Supprt System? A Decisin Supprt System can be seen as a knwledge based system, used by senir managers, which facilitates the creatin f knwledge and allw its integratin int the rganizatin. These systems are ften used t analyze existing structured infrmatin and allw managers t prject the ptential effects f their decisins int the future. Such systems are usually interactive and are used t slve ill structured prblems. They ffer access t databases,

13 analytical tls, allw "what if" simulatins, and may supprt the exchange f infrmatin within the rganizatin. Functins f a DSS DSS manipulate and build upn the infrmatin frm a MIS and/r TPS t generate insights and new infrmatin. Functins f a DSS in terms f data prcessing requirements Inputs Prcessing Outputs Internal Transactins Internal Files External Infrmatin? Mdelling Simulatin Analysis Summarizing Summary reprts Frecasts Graphs / Plts Sme examples f DSS Grup Decisin Supprt Systems (GDSS) Cmputer Supprted C-perative wrk (CSCW) Lgistics systems Financial Planning systems Spreadsheet Mdels? The rle f DSS Supprt ill- structured r semi-structured decisins Have analytical and/r mdelling capacity Used by mre senir managerial levels Are cncerned with predicting the future Are effectiveness riented? 4. Executive Infrmatin Systems What is an EIS? Executive Infrmatin Systems are strategic-level infrmatin systems that are fund at the tp f the Pyramid. They help executives and senir managers analyze the envirnment in which the rganizatin perates, t identify lng-

14 term trends, and t plan apprpriate curses f actin. The infrmatin in such systems is ften weakly structured and cmes frm bth internal and external surces. Executive Infrmatin System are designed t be perated directly by executives withut the need fr intermediaries and easily tailred t the preferences f the individual using them. Functins f an EIS EIS rganizes and presents data and infrmatin frm bth external data surces and internal MIS r TPS in rder t supprt and extend the inherent capabilities f senir executives. Functins f a EIS in terms f data prcessing requirements Inputs Prcessing Outputs External Data Internal Files Pre-defined mdels Summarizing Simulatin "Drilling Dwn" Summary reprts Frecasts Graphs / Plts Sme examples f EIS Executive Infrmatin Systems tend t be highly individualized and are ften custm made fr a particular client grup; hwever, a number f ff-the-shelf EIS packages d exist and many enterprise level systems ffer a custmizable EIS mdule. The rle f EIS Are cncerned with ease f use Are cncerned with predicting the future Are effectiveness riented Are highly flexible Supprt unstructured decisins Use internal and external data surces Used nly at the mst senir management levels Infrmatin system and cmpetitive advantage sing Infrmatin Systems t Achieve Cmpetitive Advantage

15 Firms with a cmpetitive advantage ver thers typically have access t special resurces that thers d nt r are able t use resurces mre efficiently, resulting in higher revenue grwth, prfitability, r prductivity grwth (efficiency), all f which ultimately in the lng run translate int higher stck market valuatins than their cmpetitrs. Michael Prter's cmpetitive frces mdel describes five cmpetitive frces that shape the fate f the firm. 1. Traditinal cmpetitrs: Existing firms that share a firm's market space 2. New market entrants: New cmpanies have certain advantages, such as nt being lcked int ld equipment and high mtivatin, as well as disadvantages, such as less expertise and little brand recgnitin. Sme industries have lwer barriers t entry, ie: cst less fr a new cmpany t enter the field. 3. Substitute prducts and services: These are substitutes that yur custmers might use if yur prices becme t high. Fr example, Internet telephne service can substitute fr traditinal telephne service. The mre substitute prducts and services in yur industry, the less yu can cntrl pricing and raise yur prfit margins. 4. Custmers: The pwer f custmers grws if they can easily switch t a cmpetitr's prducts and services, r if they can frce a business and its cmpetitrs t cmpete n price alne in a transparent marketplace where there is little prduct differentiatin and all prices are knwn instantly (such as n the Internet). 5. Suppliers: The mre different suppliers a firm has, the greater cntrl it can exercise ver suppliers in terms f price, quality, and delivery schedules. Figure 3-10 FIGURE 3-10 PORTER S COMPETITIVE FORCES MODEL In Prter s cmpetitive frces mdel, the strategic psitin f the firm and its strategies are determined nt nly by cmpetitin with its traditinal direct cmpetitrs but als by fur frces in the industry s envirnment: new market entrants, substitute prducts, custmers, and suppliers.

16 There are fur generic strategies used t manage cmpetitive frces, each f which ften is enabled by using infrmatin technlgy and systems: 1. Lw-cst leadership: Use infrmatin systems t achieve the lwest peratinal csts and the lwest prices. Fr example, a supply chain management system can incrprate an efficient custmer respnse system t directly link cnsumer behavir t distributin and prductin and supply chains, helping lwer inventry and distributin csts. 2. Prduct differentiatin: Use infrmatin systems t enable new prducts and services, r greatly change the custmer cnvenience in using yur existing prducts and services. Fr instance, Land's End uses mass custmizatin, ffering individually tailred prducts r services using the same prductin resurces as mass prductin, t custm-tailr clthing t individual custmer specificatins. 3. Fcus n market niche: Use infrmatin systems t enable a specific market fcus and serve this narrw target market better than cmpetitrs. Infrmatin systems supprt this strategy by prducing and analyzing data fr finely tuned sales and marketing techniques. Hiltn Htels uses a custmer infrmatin system with detailed data abut active guests t prvide tailred services and reward prfitable custmers with extra privileges and attentin. 4. Strengthen custmer and supplier intimacy: Use infrmatin systems t tighten linkages with suppliers and develp intimacy with custmers. Chrysler Crpratin uses infrmatin systems t facilitate direct access frm suppliers t prductin schedules, and even permits suppliers t decide hw and when t ship suppliers t Chrysler factries. This allws suppliers mre lead time in prducing gds. Strng linkages t custmers and suppliers increase switching csts (the cst f switching frm ne prduct t a cmpeting prduct) and lyalty t yur firm. Because f the Internet, the traditinal cmpetitive frces are still at wrk, but cmpetitive rivalry has becme much mre intense. Internet technlgy is based n universal standards, making it easy fr rivals t cmpete n price alne and fr new cmpetitrs t enter the market. Because infrmatin is available t everyne, the Internet raises the bargaining pwer f custmers, wh can quickly find the lwest-cst prvider n the Web. Sme industries, such as the travel industry and the financial services industry, have been mre impacted than thers. Hwever, the Internet als creates new pprtunities fr building brands and building very large and lyal custmer bases, such as Yah!, ebay, and Ggle. The value chain mdel highlights specific activities in the business where cmpetitive strategies can best be applied and where infrmatin systems are mst likely t have a strategic impact. The value chain mdel views the firm as a series r chain f basic activities that add a margin f value t a firm's prducts r services. These activities can be categrized as either primary activities r supprt activities. Primary activities are mst directly related t the prductin and distributin f the firm's prducts and services, which create value fr the custmer. Primary activities include inbund lgistics, peratins, utbund lgistics, sales and marketing, and service. Supprt activities make the delivery f the primary activities pssible and cnsist f rganizatin infrastructure (administratin and management), human resurces (emplyee recruiting, hiring, and

17 Figure 3-11 training), technlgy (imprving prducts and the prductin prcess), and prcurement (purchasing input). FIGURE 3-11 THE VALUE CHAIN MODEL This figure prvides examples f systems fr bth primary and supprt activities f a firm and f its value partners that can add a margin f value t a firm s prducts r services. Yu can use the business value chain mdel t identify areas where infrmatin systems will imprve business prcesses. Yu can als benchmark yur business prcesses against yur cmpetitrs r thers in related industries, and identify and implement industry best practices. Benchmarking invlves cmparing the efficiency and effectiveness f yur business prcesses against strict standards and then measuring perfrmance against thse standards.

18 Industry best practices are usually identified by cnsulting cmpanies, research rganizatins, gvernment agencies, and industry assciatins as the mst successful slutins r prblem-slving methds fr cnsistently and effectively achieving a business bjective. A firm's value chain is linked t the value chains f its suppliers, distributrs, and custmers. Infrmatin systems can be used t achieve strategic advantage at the industry level by wrking with ther firms t develp industry-wide standards fr exchanging infrmatin r business transactins electrnically, which frce all market participants t subscribe t similar standards. Such effrts increase efficiency, making prduct substitutin less likely and perhaps raising entry csts., Internet technlgy has made it pssible t create highly synchrnized industry value chains called value webs. A value web is a cllectin f independent firms that use infrmatin technlgy t crdinate their value chains t prduce a prduct r service fr a market cllectively. It is mre custmer-driven and perates in a less linear fashin than the traditinal value chain. Figure 3-12

19

20 UNIT-3 Infrmatin System planning Infrmatin management is term that cvers array f the systems and prcesses within an rganisatin t create and use f crprate infrmatin. Infrmatin Systems Planning is critical in develping and executing successful strategic plans in huge firms at glbal level. It is bserved in current business situatin that the markets are very uncertain which pushes cmpanies t adpt effective, pr-active strategies in rder t gain cmpetitive advantage. The strategy frmula is riented thrugh cmpany's peratin and bjectives based n a cautius analysis f the invlving cmpany. Objectives f infrmatin system planning are desired future psitins and destinatins the rganizatins intend t reach in rder t fulfill its missin. Infrmatin technlgy enable a set f pprtunities t gain cmpetitive advantage and t adjust the Infrmatin Systems fr the benefit f rganizatin.

21 In present scenari, infrmatin system planning is key issue faced by senir executives f cmpany. Infrmatin management planning mainly invlves in identificatin f the stage f IS in the rganizatin, identificatin f the applicatins f rganizatinal infrmatin systems, evaluatin f each f these applicatins, based n established evaluatin criteria, establishing a pririty ranking fr these applicatin and determining the ptimum architecture f IS fr serving the tp pririty applicatins. Theretical literature f the infrmatin systems planning suggests tw challenging theries f effective planning in a turbulent envirnment. One predicts that rganizatins using a frmal, cmprehensive planning apprach will be mre successful. The ther predicts that rganizatins using an infrmal, incremental apprach will be mre successful in such an envirnment. Stage mdel f Infrmatin System planning 1. Strategic planning: a. Derivatin frm the rganizatinal plan. b. Strategic fit with rganizatinal culture. c. Strategy set transfrmatin. 2. Infrmatin requirement analysis: a. Define underlying rganizatinal requirements. b. Develp sub system matrix. c. Define and evaluate infrmatin requirements fr rganizatinal sub-systems. 3. Resurce allcatin: a. Return n investment b. Charge ut c. Prtfli apprach d. Steering cmmittees. 4. Prject planning a. milestnes b. Critical path methd c. Gantt chart

22 T sum up, The Infrmatin Systems Planning is a key prcess fr the success and cmpetitiveness f cmpanies in present business envirnment. Plans explain the structure and cntent f infrmatin system and the way it is develped. The majr aim f Infrmatin Systems Planning is t recgnize the stages f IS planning in the rganizatin. System Acquisitin,Implemenatin,Evalutin Getting Started Security risks and events ccur thrughut a system s lifetime. This is true whether the system is develped internally r purchased fr n premise hsting r clud implementatin. Security shuld be embedded thrughut all phases f the system develpment life cycle, assessed during system acquisitin prcesses, and mnitred during system maintenance, including dispsal. System Develpment Fr systems develped by the institutin: 1. Investigate and review hw yur institutin manages sftware develpment fr release t the campus cmmunity. 2. Revise the prcess t ensure the security team is invlved at key pints in yur institutin s sftware develpment life cycle (SDLC). Having security at the table early and thrughut the SDLC ensures that security requirements are designed, tested and implemented when they are the least cstly. It is particularly critical t be invlved in defining security requirements at the beginning f a develpment prject and prir t implementatin t validate security requirements are met. 3. Review Micrsft s Security Develpment Lifecycle that parallels the system develpment lifecycle and can be used t assist in develping the rle f security in each f the SDLC phases. System Acquisitin Fr systems purchased by the institutin: 1. Investigate and review hw yur institutin acquires new sftware. Understand the prcurement prcesses in place when selecting vendrs; particularly fr clud services. 2. Determine whether prcesses encurage prper assessment f vendr relatinships and clud envirnments befre cntracting. Fr example, Nrthwestern University has a clearly defined prcess fr assessing vendrs Service Prvider Security Assessment. 3. Verify that prcesses include acceptance criteria which will give assurances that security requirements are met. 4. Review and evaluate previus vendr cntractual agreements fr security prtectins. Helpful dcuments: a. Data Prtectin Cntractual Language cntains sample cntractual language fr cntracts. b. Legal and Quasi-Legal Issues in Clud Cmputing Cntracts cntains infrmatin that may be useful in specifying security requirements. 5. Develp a plan, if needed, fr imprving the cntracting prcess with campus prcurement and/r ther stakehlders. 6. See Supplier Relatinships fr mre infrmatin n supplier relatinships and security cntrls IS security and cntrl Security cntrls are safeguards r cuntermeasures t avid, detect, cunteract, r minimize security risks t physical prperty, infrmatin, cmputer systems, r ther assets. They can be classified by several criteria. Fr example, accrding t the time that they act, relative t a security incident:

23 Befre the event, preventive cntrls are intended t prevent an incident frm ccurring e.g. by lcking ut unauthrized intruders; During the event, detective cntrls are intended t identify and characterize an incident in prgress e.g. by sunding the intruder alarm and alerting the security guards r plice; After the event, crrective cntrls are intended t limit the extent f any damage caused by the incident e.g. by recvering the rganizatin t nrmal wrking status as efficiently as pssible. Accrding t their nature, fr example: Physical cntrls e.g. fences, drs, lcks and fire extinguishers; Prcedural cntrls e.g. incident respnse prcesses, management versight, security awareness and training; Technical cntrls e.g. user authenticatin (lgin) and lgical access cntrls, antivirus sftware, firewalls; Legal and regulatry r cmpliance cntrls e.g. privacy laws, plicies and clauses. A similar categrizatin distinguishes cntrl invlving peple, technlgy and peratins/prcesses. In the field f infrmatin security, such cntrls prtect the cnfidentiality, integrity and/r availability f infrmatin - the s-called CIA Triad Systems f cntrls can be referred t as framewrks r standards. Framewrks can enable an rganizatin t manage security cntrls acrss different types f assets with cnsistency. Cntents [ 1Infrmatin security standards and cntrl framewrks 1.1Internatinal infrmatin security standards 1.2U.S. Federal Gvernment infrmatin security standards 1.3U.S. Department f Defense infrmatin security standards 2Telecmmunicatins 3Business cntrl framewrks 4See als 5References Infrmatin security standards and cntrl framewrks[edit] Numerus infrmatin security standards prmte gd security practices and define framewrks r systems t structure the analysis and design fr managing infrmatin security cntrls. Sme f the mst well knwn are utlined belw. Internatinal infrmatin security standards[edit] ISO/IEC 27001:2013 specifies 114 cntrls in 14 grups: A.5: Infrmatin security plicies A.6: Hw infrmatin security is rganised A.7: Human resurces security - cntrls that are applied befre, during, r after emplyment. A.8: Asset management

24 A.9: Access cntrls and managing user access A.10: Cryptgraphic technlgy A.11: Physical security f the rganisatin's sites and equipment A.12: Operatinal security A.13: Secure cmmunicatins and data transfer A.14: Secure acquisitin, develpment, and supprt f infrmatin systems A.15: Security fr suppliers and third parties A.16: Incident management A.17: Business cntinuity/disaster recvery (t the extent that it affects infrmatin security) A.18: Cmpliance - with internal requirements, such as plicies, and with external requirements, such as laws. U.S. Federal Gvernment infrmatin security standards[edit] Frm NIST Special Publicatin SP revisin AC Access Cntrl. 2. AT Awareness and Training. 3. AU Audit and Accuntability. 4. CA Security Assessment and Authrizatin. (histrical abbreviatin) 5. CM Cnfiguratin Management. 6. CP Cntingency Planning. 7. IA Identificatin and Authenticatin. 8. IR Incident Respnse. 9. MA Maintenance. 10. MP Media Prtectin. 11. PE Physical and Envirnmental Prtectin. 12. PL Planning. 13. PS Persnnel Security. 14. RA Risk Assessment. 15. SA System and Services Acquisitin. 16. SC System and Cmmunicatins Prtectin. 17. SI System and Infrmatin Integrity. 18. PM Prgram Management.