TABLE OF CONTENTS Provide an understanding of the necessity of establishing a formal structure and process for managing changes to the configuration of the organization's IA baseline
Provide a basic formal approach for managing changes to the configuration of the organization's IA baseline
Chapter 3 ("Determining the Organization's IA Baseline") defined the concept of an organization's IA baseline in terms of its physical and virtual boundaries. Five significant factors could result in changes to the organization's IA baseline.
First, there are frequent changes in organizational IT equipment and facilities. In terms of IT equipment, the organization replaces its existing hardware and software with upgraded versions of currently installed products or completely new products. For example, at the time that this book was written, organizations were replacing Windows NT with Windows 2000 and XP. In terms of facilities, the interior and exterior of existing organizational facilities undergo changes over time. These changes could result in the movement of people and IT equipment to new locations within the facilities. Also, organizations acquire or construct new facilities to better achieve their objectives.
Second, changes in the organization's business process model may necessitate changes to the IA baseline. The organization's technical (productive), political, and cultural subsystems will change over time. For example, as the organization expands or reduces the bounds of its geopolitical operational environment, its IA baseline must change accordingly to meet new requirements for information and services.
Third, the discovery of security vulnerabilities will...
