Implementation Guide › Planning Your Enterprise Implementation › Getting Management Commitment

Getting Management Commitment

A management decision to install CA Access Control is not enough to guarantee adequate security at your site. For the security project to succeed, management must be actively involved. Management must decide on security policy, procedures, and resources to be allocated to the security function, and accountability of users of the computer system. Without such management support, security procedures fall into misuse and become more of an administrative chore than a viable protection scheme. In fact, such a situation could breed a false sense of security that could lead to serious security exposures.

The security administrator should work with management to prepare a clear, inclusive security policy statement. This statement should include the following:

• Corporate policy regarding full‑time employees, part‑time employees, contract employees, and consultants
• Corporate policy concerning outside users of the system
• Behavior expected from all users of the system
• Physical protection considerations
• Security requirements of user departments
• Auditing requirements

The resulting security policy helps to ensure a CA Access Control implementation plan that is both realistic and consistent with the installation's security policy.