The Information Systems Security Officers Guide: Establishing and Managing an Information Protection Program

The ISSO's duties and responsibilities are many and sometimes quite complex and conflicting. However, as the IWC ISSO, you must never lose sight of the three basic CIAPP principles:

• Access control;

• Individual accountability; and

• Audit trails.

This triad of CIAPP must be incorporated into the IWC CIAPP. For just as a three-legged stool requires three strong and level legs to be useful, the CIAPP requires these three strong principles. Without all three, the CIAPP will topple just as a two-legged stool will topple.