this is semester research paper attached word document about the paper and instructions in detail please go through the document. any questions or concerns ping me.Thank you

Independent subcontractor alliances (ISAs) differ from Limited Joint Partners (LJPs) in that an ISA is not a direct competitor of STP. Rather, the ISA is a company that offers a subset of services to STP, or contracts with STP to provide it with necessary resources to perform the particular job at hand. For example, an ISA may be a warehousing company that provides only storage facilities for STP. Alternatively, an ISA may be a company that is engaged in service and repairs for STP’s trucks and planes, and/or provide sterilization and cleaning services for STP’s trucks and planes upon completion of a job, where STP had transported hazardous or toxic materials, requiring specific types of sterilization or cleaning services for its transport vehicles. There are other types of ISA that STP engages and contracts with. With regard to ISAs, STP is the only organization that will contract with its customer or who will be identified to the customer. STP’s customer should never be aware that STP has subcontracted some of its services from the ISA. There will be no negotiations, contracts or agreements between STP’s customers and STP’s ISAs. STP will then enter into its own separate subcontractor contract with its ISA, and the ISA is not identified to STP’s customer. There is no definitive number of ISAs that contract with STP. The specific ISAs used (if any) will vary depending on the geographic location or area of the country involved and the availability and cost of the ISA available to service the area.

STP is also under pressure from several of its competitors in the industry. The competitive market is driving STP to improve its routes, delivery methods, fleet vehicles, and other facets of its business to increase profits (a strategic goal) and to reduce costs. The company realizes that its information technology infrastructure has been neglected for some time and that many operating locations are running on outdated hardware and software. On several occasions last year, STP suffered no less than four network compromises through one of its LJP Internet sites that led to the disclosure of sensitive and strategic information on contracts and mergers.

The chief information officer (CIO) made a strategic presentation to the board of directors and executive management to first assess the aging infrastructure and then, develop a multi-year phased approach to have all of STP’s own sites running the same hardware and software platforms. Of course, STP has no control over the hardware or software platforms used by its LJPs and ISAs, although they must be able to communicate with each other.

Information about the assessment indicates that the current state core infrastructure (switches, routers, firewalls, servers, and so on) must be capable of withstanding 10-15% growth every year for the next seven years with a three-to-four-year phased technology refresh cycle.

There is a hodgepodge of servers, switches, routers, and internal hardware firewalls. Nearly all of the infrastructure is woefully out-of-date in terms of patches and upgrades. This operational neglect has unduly increased the risk to the network, in terms of confidentiality, integrity, and availability. Since this will be a multi-year technology upgrade project, something must be done to reduce STP’s exposure to vulnerabilities to increase the overall security profile and reduce the risk profile.

Now that the funding has been approved for the infrastructure assessment, the CIO has decided that it might be a good idea to implement an Information Governance Program into the organization, assuming he can sell the corporation on its benefits. To that end, the CIO has hired you as IG Project Manager to assist in initial preparatory stages.

STP Job Roles: In addition to the CIO, below is a list of individuals at STP to whom you have been introduced. The CIO has informed you that you can call upon any or all of the individuals who hold these job roles/titles for assistance and may name any of them to be on your project team. You may also call upon any of the heads of the various business units for assistance, as well as a designated contact person for each of STP’s LJPs and ISAs.

* This individual is also a member of STP’s Board of Directors.

SEMESTER PROJECT – PHASE I

Introduction to the Company:

Security Transport Professionals Incorporated (STP), has its home office located in Lexington, Kentucky and in addition has more than 3,000 employees located in each of its branch offices located in Houston, Texas and San Diego, California.

STP is primarily a nationwide freight hauler. Its customer are comprised of major market retailers particularly in the medical and pharmaceutical industry, the federal government, and several state governments. STP operates a fleet of trucks and private cargo planes that it uses to move “goods” belonging to its customers from one destination to another across the continental United States. Its fleet of truck carriers are located in Lexington, Kentucky with it planes located in Louisville, Kentucky.

STP carries and transports highly controlled, narcotics and scheduled prescription drugs, toxic, radioactive, nuclear, and top secret materials from one facility belonging to its customer to another. The method of transport depends on the type of cargo being hauled. In addition to hauling/forwarding its customers products/goods, STP is required from time to time to store its customer goods for brief periods of time. Two years ago STP began contracting with a number of subcontractors hereafter referred to as either “limited joint partners (LJPs)” or “independent subcontractor alliances (ISAs)” for the purpose of expanding its freight forwarding, storage, and delivery service. Due to the confidential nature of the freight that it transports, STP vets its employees, as well as any subcontractors (LJPs and ISAs) that it engages.

STP’s business objectives and goals include the confidential, safe and secure movement of its customer goods, from the customer/distributor to its client, or from one of its customer’s locations to another of the customer’s locations in a timely and efficient manner using cost- effective methods. Alternatively, STP may transfer this responsibility to one of its limited joint partners (LJPs) or independent subcontractor alliances (ISAs), if it is more cost-effective and the income differential is within acceptable limits. There are 3 LJPs with which STP had entered into

contracts. LJPs are corporate organizations in the same industry that offer essentially the same services as STP, and who are generally competitors of STP. However, when the job requires resources that exceed those of STP or its competitor, the two will enter into an agreement to jointly undertake the contract together, and will together provide the same full range of services, with both entering into the same contract or joint venture with the customer.

Independent subcontractor alliances (ISAs) differ from Limited Joint Partners (LJPs) in that a ISA is not a direct competitor of STP. Rather, the ISA is a company that offers a subset of services to STP, or contracts with STP to provide it with necessary resources to perform the particular job at hand. For example, an ISA may be a warehousing company that provides only storage facilities for STP. Alternatively, an ISA may be a company that is engaged in service and repairs for STP’s trucks and planes, and/or provide sterilization and cleaning services for STP’s trucks and planes upon completion of a job, where STP had transported hazardous or toxic materials, requiring specific types of sterilization or cleaning services for its transport vehicles. There are other types of ISA that STP engages and contracts with. With regard to ISAs, STP is the only organization that will contract with its customer or who will be identified to the customer. It will then enter into its own separate subcontractor contract with its ISA, and the ISA is not identified to STP’s customer. There is no definitive number of ISAs that contract with STP. The specific ISAs used (if any) will vary depending on the geographic location or area of the country involved and the availability and cost of the ISA available to service the area.

STP is also under pressure from several of its competitors in the industry. The competitive market is driving STP to improve its routes, delivery methods, fleet vehicles, and other facets of its business to increase profits (a strategic goal) and to reduce costs. The company realizes that its information technology infrastructure has been neglected for some time and that many operating locations are running on outdated hardware and software. On several occasions last year, STP suffered no less than four network compromises through one of its LJP Internet sites that led to the disclosure of sensitive and strategic information on contracts and mergers.

The chief information officer (CIO) made a strategic presentation to the board of directors and executive management to first assess the aging infrastructure and then, develop a multi-year

phased approach to have all sites (except for LJP and ISA) on the same hardware and software platforms.

Information about the assessment indicates that the current state core infrastructure (switches, routers, firewalls, servers, and so on) must be capable of withstanding 10-15% growth every year for the next seven years with a three-to-four-year phased technology refresh cycle.

There is a hodgepodge of servers, switches, routers, and internal hardware firewalls. Nearly all of the infrastructure is woefully out-of-date in terms of patches and upgrades. This operational neglect has unduly increased the risk to the network, in terms of confidentiality, integrity, and availability. Since this will be a multi-year technology upgrade project, something must be done to reduce STP’s exposure to vulnerabilities to increase the overall security profile and reduce the risk profile.

Now that the funding has been approved for the infrastructure assessment, the CIO has decided that it might be a good idea to implement an Information Governance Program into the organization, assuming he can sell the corporation on its benefits. To that end, the CIO has hired you as IG Project Manager to assist in initial preparatory stages.

STP Job Roles: In addition to the CIO, below is a list of individuals at STP to whom you have been introduced. The CIO has informed you that you can call upon any or all of the individuals who hold these job roles/titles for assistance and may name any of them to be on your project team. You may also call upon any of the heads of the various business units for assistance, as well as a designated contact person for each of STP’s LJPs and ISAs.

• Chief Executive Officer (CEO)*

• Chief Information Officer (CIO)*

• Chief Financial Officer (CFO)*

• Executive VP of Marketing*

• VP of Human Resources

• In-house Counsel

• In-house Financial Analyst and Risk Manager

• Senior Records Manager

• Senior IT Manager

• IT Security Expert

• Overland Transport Manager

• Airway Transport Manager

• Overland Transport Manager

• Airway Transport Manager

• Southern Region General Manager (Houston, Florida)

• Western Region General Manager (San Diego, California)

• Information Security Specialist

• This individual is also a member of STP’s Board of Directors

INSTRUCTIONS: While it should go without stating, information related to each of STP’s customers and the products that you are transporting for them is highly sensitive, and in some cases top secret. You want to make sure that any IG Program that STP ultimately implements will allow STP to retain all of the information about its customers, the product transported, and the particular haul that it is required to keep pursuant to federal and state law. You want to insure STP that the proper information will be retained that it might need for purposes of litigation and e-discovery. At the same time, you don’t want STP to keep unnecessary information for extended periods of time, thereby increasing the cost and time involved with processing and retention.

1. First, select and list 10 individuals to serve on your IG project team. Explain why you selected the team members that you did.

1. Conduct the necessary research for each of STP’s state of home office (Kentucky), and for the state of each of its primary hubs (Texas and California), that will allow you to (a) educate yourself and your team members on the mandatory information retention requirements and privacy consideration for each of the three states, and (b) be able to intelligently discuss the legal and regulatory requirements with in-house counsel. You will want to conduct internet research on this and may also want to review Appendix B in your text book. Do not ignore this area of the project.

1. Ultimately, your team will be required to create a “risk profile” and risk analysis, that will describe the set of risks facing STP in achieving its business objectives while protecting its information and that of its customers, LJPs and ISAs, and which will allow STP to assess the likelihood these risks hold and their potential impact, if materialized, and in addition will permit STP to identify risk mitigating factors to be implemented. You need to brainstorm in order to present the information to your team members that will facilitate the creation of a risk profile and analysis. To that end, create a top-10 list of the greatest risks to information that STP will face, ranking your list in order from highest or greatest risk to lowest, for each risk identified, state whether you believe the risk could be assumed, transferred or mitigated in full or in part. Also, for each risk identified identify the individual, title or business unit that the team member will want to contact in order to obtain additional information about the fundamental activity that will assist your team in fully completing the risk profile and analysis.

It should be completed in a WORD format. Use 1-inch margins on each page. Include a cover page that will contain the Course name and number, semester term, your full name, student id, and the title “STP IG PROGRAM IMPLEMENTATION – PHASE 1”.

Assignments will not be accepted late!

PROJECT – PHASE II

Please review the description of the organization that is the subject of your semester project. The description of that organization, Security Transport Professionals, Incorporated, (STP) is described in the instructions for Phase I that you have already completed.

1. This phase will involve performing a records inventory. The organization is far too large to undertake a records inventory for the entire company. You will need to make a determination of which program or division or functional area whether that be (a) the narcotic/drugs that you ship/store, (b) the top secret materials that you ship/store, or (c) the toxic or dangerous materials that you ship/store to include in its records inventory. Once you have made that determination, decide which of the managers/personnel previously identified that you will need to contact/interview and work with in order to complete the records inventory for the functional area that your group has selected. It will most likely include more than one of the personnel/departments listed above. As project manager you have decided to collect information using a two-step approach where you first send out survey questions and then once you have received the responses you will follow up by conducting interviews.

1. 1. State whether you intend to focus on the narcotic/drug area, top secret materials for the government, or toxic or dangerous materials/chemicals.

1. 1. Identify which of the above department(s)/areas/units that you will need to survey and subsequently interview, depending on which one of the three functional areas you have decided to focus your attention on.

1. 1. For the functional area that you have selected you want to be able to speak intelligently to the knowledge personnel within that department and ask appropriate and relevant questions. Therefore, you need to do some preparation and brainstorming before making contact with the departments/units that you have identified as essential. To that end, identify (using diagram, table, hierarchy chart, taxonomy, or other form that is most descriptive) the “record types” that you expect are created and maintained in each of the departments/areas/units that you have decided to focus on. Use descriptive names for each record type and tell the type of information that would be retained in each record type. This can be as specific as creating a taxonomy for the record if you should decide to do so (see Appendix A in your text book), or you may conduct research and determine what other structure would be appropriate in order to convey this information. The most effective way to convey this information to me would be in the form of a table that identifies the Record Type, Responsible Department, and the Event that triggers the creation of each record type. [For example, if we were dealing with a health care provider (WHICH WE ARE NOT, I am only using this unrelated example to give you an idea of what I want you to do), an

example of a record type that your doctor’s office might keep would be an Insurance Record that would include things like information about the Insurer, information about the patient, information about the insured if different from the patient, information about the plan options and conditions of coverage, information about the insured history of using this insurance in the past and the prior payment record.] [Another example: You will find a record type used on page 172 of your text book to describe a workers’ compensation insurance company’s accident/injury report as part of its record retention schedule.]

1. 1. Develop a Records Inventory Survey Form that you are going to use in surveying the departmental unit(s) you have identified above. The purpose for your survey is to be able to identify the kinds of records (contracts, financial reports, memorandum, invoices, etc.), which department owns the records, which departments access the records, what application creates the record, where the record is stored physically and logically, date created, last changed, whether it is a vital record, and whether there are other forms of the record. You want to be able to use this information to make decisions related to retention and disposal of the records. Explain who will receive the survey and why. The survey will be sent about one month prior to the follow up interviews. This will allow for two (2) weeks to complete and return the survey and two weeks to tabulate and review it, and to tweak your interview questions, depending on the results of the survey. Explain the rationale for the questions that you included in your survey.

1. 1. Develop an initial set of interview questions that you plan to use as a follow up to the initial survey that you drafted in (d) above.

1. 1. Based upon the records you have identified above, develop a record retention schedule and for the record types. Include in this the method of destruction when the record is marked for destruction. Explain whether you are going to use event-based retention for any of your record types and if so why, and identify the triggering event. For this question, you need to discuss the legal requirements and compliance considerations.

THE RESEARCH PAPER: While your research paper will undoubtedly include a number of tables, diagrams, lists and other illustrations, the paper is to be written in narrative form. The illustrations may be included in appendix at the end of the paper, or may imbedded in the body. But please don’t forget that the paper itself is written in narrative form. Include citations to your research.

The paper should be written in narrative form using the APA format. Please use ample subsections or subheading as appropriate. Your paper should have a 1-in margin on top, bottom, left and right margins. The paper should be double spaced. Use a cover page with a title, and the name of each team member who contributed to your project/paper. Each page should have a page number in the bottom right margin. The paper should also include a table of contents, which includes subject headings, subheadings or subtopics, references or sources, and illustrations as well as page numbers for each.

For each major area or section of your paper explain identify the options you have considered, where applicable. Discuss the alternatives you considered, giving pros and cons of

each, and provide information from the research you conducted that assisted you in arriving at your conclusion as to why one alternative was selected over another. You MUST cite the sources for your research any time you make reference to your research, whether that be through direct quotations or in summary. Your work should include no fewer than five (5) sources. While there is no minimum or maximum length for your paper, I anticipate that you cannot complete the assign in under ten (10) pages, excluding illustrations.

SEMESTER PROJECT – PHASE III

ADDITIONAL INFORMATION FOR PHASE III

Security Transport Professionals (STP) Incorporated desires to increase its share of the transportation market for high risk, sensitive, top secret, regulated “goods” by establishing itself as being the premier freight hauler who can rise to the task of moving its customer’s product to its destination in the quickest, most efficient, confidential, safe and secure manner possible, while maintaining a comparable cost of moving and storage. This means that it wants to be identified as THE hauler who incurs the smallest amount of damage, destruction, and delays to the customer’s product while the product is in STP’s care and possession, and who transports the product in a legally defensible manner, exposing its customers the smallest legal exposure possible. STP’s objectives include having a system of management and governance of its data that is readily accessible for decision making, secure and exposes the organization to the smallest degree of risk possible. The strategic plan for achieving this organizational objective includes designing, planning, implementing, testing, auditing, evaluating, and continual updating or revising an overall organizational Information Governance program that is aligned and synchronized with the organizations’ overall strategic plans, goals and business objectives. The Information Governance program should include key concepts from records management, content management, Information Technology and data governance, information security, data privacy, risk management, litigation readiness, regulatory compliance, long-term digital preservation and business intelligence. To do this, STP recognizes that in order to support the organizational objectives, its Information Governance (IG) goal must be to design and implement a plan/program that provides for a standardized and systematized method of handling information wherein it can efficiently analyze and optimize how information is accessed, controlled, managed, shared, stored, preserved and audited.

During Phase I, you as the project manager have had an opportunity to give some thought to which members of the organization you would want to have on your IG team from those listed in the project description who have expressed an interest in assisting in the creation of the IG program at STP. You have also had an opportunity to give some thought to what you expect might be the greatest security risks that STP may face through your risk analysis and risk profile. You have had an opportunity to research the differing regulations in the different states where STP operates primarily. In Phase II you had an opportunity to consider the types of records STP deals with through your records inventory for a least one area of the organization. You have considered a records retention plan and have identified the types of records that may be periodically tagged for destruction, which should be archived, and which are subject to long term digital preservation. You are now ready to design your first Information Governance Program.

While it should go without stating, information related to each of STP’s customers and their products is highly sensitive, and in some cases top secret. You want to make sure that the IG Program that STP implements will allow STP to retain all of the information about its customers, the product transported, and the particular haul that it is required to keep pursuant to federal and

state law. You want to insure STP that the proper information will be retained that it might need for purposes of litigation and e-discovery. You will need to consider disaster recovery and business continuity. You don’t want STP to keep unnecessary information for extended periods of time, thereby increasing the cost and time involved with processing and retention, and also increasing STP and its customers to litigation risks. Therefore, you will want to give serious consideration to STP’s data disposition or disposal plans.

INSTRUCTIONS FOR PHASE III

You are to prepare an Information Governance Policy/Program for STP. All IG policies or programs are somewhat different and unique to the industry and to the organization. There are a number of sample Information Governance Policy/Program templates and samples on the internet. Attached to the end of this document is a sample Information Governance Policy template that was copied verbatim from the website https://www.infogovbasics.com/creating-a-policy/.

Please feel free to browse the internet to get a flavor for what an actual IG Policy/Program might look like. If you desire, use the template attached to the end of this document as an outline for how you might choose to format your IG Policy/Program for STP and what you might want to include in your IG policy/program. It is certainly not a requirement that you use the attached sample as a guideline for formatting your own. You may determine that you have something better! This sample at the end of this document is merely attached as one example of what might be contained in your IG policy/program, and in what format. Browse as much as you want to determine how you want to format your own IG Policy/program, and the types of things you will include. Even if you do decide to use the attached sample, still you are required to customize this sample to meet the distinct characteristics and needs of STP.

Please do not misconstrue the sample/example format attached hereto. You must complete the actual content or provide instruction for each section listed, and include your own sections where appropriate. For example, you will see on one portion of the attached example the following:

The first major section of most frameworks clearly define key roles and their responsibilities, including:

Information Governance Committee Information Governance Team Information Risk Management Information Asset Management Records Manager

Line-of-Business Managers Employees

“Roles and Responsibilities” is merely a category or heading for one portion of the IG policy/program. The sentence that reads, “The first major section of most frameworks clearly define key roles and their responsibilities including:” is nothing more than an instruction from me to you describing the section. Then the 7 lines that follow is just an example of the key players for this particular example. It still needs to have the roles and responsibilities inserted and described in sentence form for each of those 7 positions listed. So you will not include in your IG policy/program my description of what each category is used for. Please remember that I said I want you to use sentence form. Please don’t just give me listings like each of the 7 listed in the Roles and Responsibility example above. The IG policy/program that you submit should be so much more than just bullet items with sentences of explanation. You will lose a significant number of points if you decide to give me bulleted items only.

However, please, please, please do not plagiarize by copying another IG policy that you find on the internet (or anywhere else). Remember I will run the IG Policy that you submit through a plagiarism checker that will compare it with others on the web and with those of the other students in the class. Where it finds a match it will give me the source. In addition, it will break down your paper and will tell me what percentage of your entire paper was plagiarized from different sources. If you use anything from an IG policy that you find on the Internet, please give credit to the source so that the plagiarism issue will not come up. If you find a good IG policy/program on the internet, or from any other source, please give credit to the source by listing it as a reference. If you use the sample that is attached hereto, please reference it as well. References should be in the form of endnotes, and not footnotes as footnotes would most likely detract from the IP Policy/Program.

The IG Policy that you develop should be specific to STP and unique to the organization’s needs. Where you decide that STP should use cloud computing, mobile devices, and to the extent that you decide that it is appropriate for STP to engage in enterprise social media, state the decisions you have made as those things will be reflected in your IG policy. Explain any decisions or assumptions you have made for STP that were not outlined in the description of the company.

Make sure to submit the project in WORD format. Use 1-inch top, bottom, left and right margins on each page. Include a cover page that will contain the Course name and number, semester term, your full name, student id, and the title “STP INFORMATION GOVERNANCE POLICY/PROGRAM IMPLEMENTATION

PHASE III”.

SAMPLE TEMPLATE FOR FORMAT AND CONTENT OF AN INFORMATION GOVERNANCE POLICY

The remainder of this paper was reproduced for educational purposes in its entirety from: https://www.infogovbasics.com/creating-a-policy/

The framework should begin by establishing the full extent of the Information Governance program. An example of this could be:

“The Information Governance framework covers all staff that create, store, share and dispose of information. It sets out the procedures for sharing information with stakeholders, partners and suppliers. It concerns the management of all paper and electronic information and its associated systems within the organization, as well as information held outside the organization that affects its regulatory and legal obligations.”

The first major section of most frameworks clearly define key roles and their responsibilities, including:

Information Governance Committee Information Governance Team Information Risk Management Information Asset Management Records Manager

Line-of-Business Managers Employees

Information Governance covers a wide range of policies. The framework should set out which corporate policies are relevant to the Information Governance program. These may include:

• Information security policy

• Records management policy

• Retention and disposal schedules

• Archiving policy

• Data privacy policy

• ICT policy

• Information sharing policy

• Remote working policy

A major part of the Information Governance framework should set out how the organization and its employees work with information. This can be broken into separate sections covering:

• Legal and regulatory compliance

• Creating and receiving information

• Acceptable content types

• Managing the volume of information

• Managing personal information

• Storing and archiving information

• Collaboration and sharing information

• Disposing of information

As more and more information that affects a business is created and stored elsewhere it is essential to establish how the organization operates and shares information with stakeholders, partners and suppliers. The framework should:

• Define the policies for sharing information with third parties

• Define how the organization can manage how third parties handle personal and confidential information

• Define how Information Governance fits within supplier relationships and contractual obligations

• Define measurement and metrics for third party meeting the organization’s Information Governance goals

The framework should set out the organization’s approach to:

• Reporting information losses

• Reporting information security breaches

• Incident management and escalation

• Back up and disaster recovery

• Business continuity management

Information Governance is a continuous improvement process so it must be underpinned by a continuous monitoring procedure. The framework can set out the organization’s approach to:

• Monitoring information access and use

• Monitoring effectiveness of regulatory compliance

• Monitoring the effectiveness of information security policy and procedure

• Monitoring of ICT and storage infrastructure performance

• Risk assessment and auditing

• Information Governance review

Like many things in Information Governance, there is a balance to be achieved with the Information Governance framework. The more comprehensive the document, the better. However, it shouldn’t become so large and unwieldy that it ends up gathering dust on the shelf.