Section "qualification characteristics of positions of managers and specialists in ensuring information security in key systems of information infrastructure, countering technical intelligence and technical protection of information". Section "qualify

Download job description
information security specialist(.doc, 75KB)

I. General provisions

For the position:
- an information security specialist is appointed a person with a higher professional (technical) education without presenting requirements for work experience;
- Category II information security specialist - a person with a higher professional (technical) education and work experience in the position of an information security specialist or other positions filled by specialists with higher professional education for at least 3 years;
- information security specialist of category I - a person with a higher professional (technical) education and work experience as an information security specialist of category II for at least 3 years.
Appointment to the position of an information security specialist and dismissal from it is carried out by order of the director of the enterprise on the proposal of the head of the information security department.
The Information Security Specialist should know:
1. 3.1. Legislative acts, regulatory and methodological materials on issues related to ensuring the protection of information.
2. 3.2. Specialization of the enterprise and features of its activity.
3. 3.3. production technology in the industry.
4. 3.4. Equipment of computing centers with technical means, prospects for their development and modernization.
5. 3.5. The system of organization of complex protection of information operating in the industry.
6. 3.6. Methods and means of controlling protected information, identifying information leakage channels, organizing technical intelligence.
7. 3.7. Methods for planning and organizing work to protect information and ensure state secrets.
8. 3.8. Technical means of control and protection of information, prospects and directions for their improvement.
9. 3.9. Methods for conducting special studies and inspections, works to protect the technical means of transmission, processing, display and storage of information.
10. 3.10. The procedure for using abstract and reference publications, as well as other sources of scientific and technical information.
11. 3.11. Achievements of science and technology in the country and abroad in the field of technical intelligence and information protection.
12. 3.12. Methods and means of performing calculations and computational work.
13. 3.13. Fundamentals of economics, organization of production, labor and management.
14. 3.14. Fundamentals of labor legislation.
15. 3.15. Rules and norms of labor protection, safety measures, industrial sanitation and fire protection.
During the absence of an information security specialist (vacation, illness, etc.), his duties are performed by a duly appointed person. This person acquires the appropriate rights and is responsible for the proper performance of the duties assigned to him.

II. Job Responsibilities

Information protection specialist:

Performs complex work related to ensuring comprehensive protection of information based on the developed programs and methods, observance of state secrets.
It collects and analyzes materials from institutions, organizations and enterprises of the industry in order to develop and make decisions and measures to ensure the protection of information and the effective use of automatic control tools, detect possible channels for leaking information representing state, military, official and commercial secrets.
Analyzes the existing methods and means used to control and protect information, and develops proposals for their improvement and increasing the effectiveness of this protection.
Participates in the examination of objects of protection, their certification and categorization.
Develops and prepares for approval draft regulatory and methodological materials governing the work on information protection, as well as regulations, instructions and other organizational and administrative documents.
Organizes the development and timely submission of proposals for inclusion in the relevant sections of long-term and current work plans and programs of measures to control and protect information.
Gives feedback and opinions on projects for newly built and reconstructed buildings and structures and other developments on issues of information security.
Participates in the review of technical specifications for design, draft, technical and working projects, ensures their compliance with current regulatory and methodological documents, as well as in the development of new circuit diagrams of control equipment, control automation tools, models and information security systems, assessment of the technical and economic level and the effectiveness of the proposed and implemented organizational and technical solutions.
Determines the need for technical means of protection and control, draws up applications for their purchase with the necessary justifications and calculations for them, controls their supply and use.
It checks compliance with the requirements of intersectoral and sectoral regulatory documents on information security.

III. The rights

The information security specialist has the right to:

Get acquainted with the draft decisions of the management of the enterprise regarding its activities.
Submit proposals for improvement of the work related to the responsibilities provided for in this instruction for consideration by the management.
Within the limits of his competence, inform his immediate supervisor of all shortcomings in the activities of the enterprise (its structural divisions) identified in the course of the performance of official duties and make proposals for their elimination.
To request personally or on behalf of his immediate supervisor from specialists of departments information and documents necessary for the performance of his duties.
Involve specialists from all (individual) structural divisions in solving the tasks assigned to him (if this is provided for by the regulations on structural divisions, if not, then with the permission of their heads).
Require from his immediate supervisor, the management of the enterprise to assist in the performance of his duties and rights.

IV. Responsibility

The Information Security Specialist is responsible for:

For improper performance or non-performance of their official duties provided for by this job description - within the limits determined by the current labor legislation Russian Federation.
For offenses committed in the course of carrying out their activities - within the limits determined by the current administrative, criminal and civil legislation of the Russian Federation.
For causing material damage— within the limits determined by the current labor and civil legislation of the Russian Federation.

APPROVE:
Supervisor _____________________
__________________________________
(__________________)
"___"________ ___ G.
M.P.

JOB INSTRUCTIONS for a technical information security specialist

1. GENERAL PROVISIONS

1.1. real job description defines functional responsibilities, rights and responsibilities of a technical information security specialist _______________ (hereinafter referred to as the Organization).

1.2. The specialist in technical information protection is appointed to the position and dismissed in accordance with the procedure established by labor legislation by order of the head of the Organization.

1.3. The technical information security specialist reports directly to _______________ Organization.

1.4. Qualifications to the person appointed to the post:

Specialist in technical information protection of the 1st category: higher professional education in the specialty "Information Security" and work experience as a specialist in technical protection of information of the II category for at least 3 years.

Specialist in the technical protection of information of the II category: higher professional education in the specialty "Information Security" and work experience in the position of a specialist in the technical protection of information or in other positions filled by specialists with higher professional education, at least 3 years.

Specialist in technical information protection: higher professional education in the specialty "Information security" without presenting a requirement for work experience.

1.5. An information security specialist should know:

Laws and other regulatory legal acts of the Russian Federation regulating relations related to the protection of state secrets and other restricted information;

Regulatory and methodological documents on issues related to ensuring the protection of information;

Methods and tools for identifying threats to information security, ways to identify channels of information leakage;

Specialization, the basics of the technological processes of production of the Organization and the consequences of their violation;

The structure of management, communications and automation, the equipment of the Organization's informatization facilities with the main and auxiliary technical means and systems, the prospects for their development and modernization;

Achievements of science and technology in the country and abroad in the field of technical intelligence and technical protection of information; prospects and directions of development of technical and hardware-software means of information protection;

The procedure and content of special studies and control checks, work on categorization, certification of informatization objects and other work on the technical protection of information;

Methods for planning work on the technical protection of information;

Methods for conducting scientific research, development on the technical protection of information;

Documentation developed at informatization facilities for the technical protection of information;

Rules for the development and preparation for approval of draft regulatory and methodological documents governing the work on the technical protection of information, drawing up inspection reports, test reports, instructions for the right to operate means of technical protection of information, as well as regulations, instructions and other documents in the field of technical protection of information;

Structure, purpose, tasks, powers of the department for technical protection of information;

The procedure for the use of regular means of technical protection of information and control of its effectiveness;

Access control subsystems, attack detection subsystems, methods for analyzing the results of checks, accounting for violations of requirements for technical information protection;

The procedure for preparing proposals, methods and means of performing computational work in the interests of planning, organizing and carrying out work on the technical protection of information;

The procedure for creating secure channels between interacting objects through a public system using dedicated communication channels;

The procedure for the implementation of authentication of interacting objects, authentication of the sender and integrity of data transmitted through the public system;

The procedure for using abstract and reference publications, as well as other sources of scientific and technical information;

Achievements of science and technology in the country and abroad in the field of technical intelligence and technical protection of information;

Basics of labor legislation;

Rules on labor protection and fire safety.

1.6. During the period of temporary absence of a specialist in technical protection of information, his duties are assigned to ____________________.

2. FUNCTIONAL RESPONSIBILITIES

Information Security Specialist:

2.1. Performs work on the technical protection of information in organizations.

2.2. Carries out work to identify threats to information security, determine the possibility of technical intelligence and carry out measures for the technical protection of information.

2.3. Participates in the categorization of informatization objects, identification of threats to information security and technical channels of information leakage, works on conducting special checks and special studies of informatization objects.

2.4. Develops proposals for the placement of main and auxiliary technical means and systems in compliance with the established standards of technical information protection.

2.5. Organizes and conducts (if necessary) measures for the technical protection of information when placing third-party organizations within the controlled zone.

2.6. Participates in the examination of informatization objects, their categorization and certification.

2.7. Develops and prepares for approval drafts of normative and methodological documents regulating the work on the technical protection of information, inspection reports, test reports, instructions for the right to operate, as well as regulations, instructions and other organizational and administrative documents.

2.8. Participates in determining the need for technical information security tools, draws up applications for their purchase with the necessary justifications and calculations for them, controls their supply and use.

2.9. Carries out verification of compliance with the requirements of regulatory documents on the technical protection of information.

3. RIGHTS

The information security specialist has the right to:

3.1. Require the management of the Organization to assist in the performance of their duties.

3.2. Get acquainted with the draft decisions of the management of the Organization relating to its activities.

3.3. Submit proposals on the issues of their activities for consideration by their immediate supervisor.

3.4. Receive official information necessary for the performance of their duties.

4. RESPONSIBILITY

The information security specialist is responsible for:

4.1. For failure to perform or improper performance of their duties stipulated by this job description - in accordance with the current labor legislation.

4.2. For offenses committed during the period of its activities - in accordance with the current civil, administrative and criminal legislation.

4.3. For causing material damage - in accordance with applicable law.

5. CONDITIONS AND EVALUATION OF WORK

5.1. The mode of operation of a specialist in technical protection of information is determined in accordance with the rules of the internal work schedule set in the organization.

5.2. Job evaluation:

Regular - carried out by the immediate supervisor in the process of performance by the Employee of labor functions;

- ________________________________________________________________________. (indicate the procedure and grounds for other types of work)

This job description was developed in accordance with the Order of the Ministry of Health and Social Development of the Russian Federation dated April 22, 2009 N 205 "On approval of the Unified qualification handbook positions of managers, specialists and employees, section "Qualification characteristics of positions of managers and specialists in ensuring information security in key systems of information infrastructure, countering technical intelligence and technical protection of information".

____________________________ ________________ ___________________________ (Position name (Personal signature) (Signature decoding) of the head of the structural unit) "___" ____ AGREED (indicate all interested parties and their signatures) ____________________________ ________________ ___________________________ (Personal signature) (Signature decoding) "___" __________ ____ d. I am familiar with the instructions: ________________ ___________________________ (Personal signature) (Signature decoding) "___" __________ ____ d.

Information is one of the main values of the organization, requiring the protection and control of its use. The further the development of information technology goes, the more information is transferred to electronic media, and paper options for storing data are becoming less relevant. Created databases, software, enterprise documentation must be reliably protected both from unauthorized use and from distribution outside the enterprise.

To accomplish this task, organizations hire specialists with the ability to provide such protection and create conditions for the use of information by employees of the enterprise within the framework of the rules being created.

About document

The position of an information security specialist in different organizations is understood in their own way.

In some companies, the functions of these employees include duties related to the protection of any type of information. As a rule, such specialists are included in the structure of economic security departments.
In other enterprises, the information security specialist works exclusively with electronic information systems, in which case such employees are most often included in the IT departments and report to.

Development goals and objectives

Since the job description is not a document that is mandatory for development in the organization, it can take the form that is convenient for the employer. But whatever format is chosen, it must solve the main task - to determine the requirements of the position for the employee and form a specific list of duties that he will perform at his workplace.

Regulations

The development of a job description for this specialist can be regulated not only by external regulations that define the requirements for protecting information at the level of the entire state.

Since September 2016 a professional standard for the position of "Specialist in the protection of information in automated systems" was put into effect, which can become the basis for the development of DI.
The main internal document on the basis of which the development of instructions can begin can be the concept of an enterprise for security, which reflects all the basic requirements for protecting the organization's information.
Also, for development, internal regulations for the protection of personal data of employees, rules for the use of information tools and databases by the organization's personnel, regulations for delimiting access rights and other internal regulatory documentation that reflect the requirements for the protection of enterprise information can be used.
Valuable information for the development of DI is contained in formalized business processes for functional areas in which a specialist is involved.

Types of CI

The job description can be developed in the form of a standard DI that applies to the positions of information security specialists available in the structure of organizations included in. This form can only be used if the requirements for positions, functions, rights and responsibilities are completely identical in these companies.

Today, companies use both standard DIs and other versions of documents that allow fixing the functions of the position, the duties of the employee, his rights and responsibilities. Such forms may include the conclusion of an agreement, which briefly outlines the duties of an employee, and a separate appendix is created to the agreement with detailed information necessary to standardize the requirements for an employee. Another form used by organizations to standardize employee requirements is the job profile or job standard.

If each position has its own functionality, a different system of subordination is assumed, it is required to develop an individual instruction for each position.

Who makes up

Responsibilities for compiling DI in different companies are assigned to different employees. Most often, development is carried out by several workers. Such a working group includes an information security specialist, or, as well as, or,. Sometimes also participates.

HR department employees are responsible for determining the form of the document, applying the requirements of the professional standard in the development of DI, organizing the development process.
Immediate supervisor defines the description of the sections related to the requirements for employees, the scope of job responsibilities.
legal adviser checks the document for compliance with internal requirements, reflects all the legal aspects of the functioning of the position in the organization: the procedure for appointment and dismissal, the rights and responsibilities of the employee.

The final version, as a rule, is formed by specialists of HR departments and organizes the procedure for agreeing and approving the document by the director of the enterprise.

Where is used

The instruction is used in almost all personnel management processes:

when hiring new employees and determining requirements for applicants for a position;
to determine the key competencies that should be assessed both at the stage of selection of candidates and for the ongoing assessment of the organization's personnel;
during the implementation of adaptation programs;
when resolving labor conflicts and disagreements arising between the employee and the employer.

Provisions of the job description of a specialist and an information security engineer

The provisions of the job description of an information security specialist should contain all information about the position, including its place in the overall structure, the requirements of the position for the employee, detailed information about the duties, his rights and responsibility for achieving the required results.

Are common

AT general provisions information about the job title is entered. In accordance with the professional standard for an information security specialist, there are two categories: I and II. However, if an enterprise is not required by law to without fail apply the requirements of the standard, then categories may not be assigned to employees.

This section of the instruction defines the subordination of a specialist, describes the organizational structure of the unit.
Important information reported in this part of the CI is education, work experience, and seniority requirements.
According to prof. standard, the employee must have a higher education and a bachelor's degree in information security. Work experience is not required if the employee does not perform a number of duties, information about which can be found in the text of the standard. If its functionality is wide enough, then work experience of at least one year may be required.
In terms of additional education, the standard recommends that an employee take refresher courses in the field of information security.
In terms of employee access to work with information, if necessary and a certain profile of the enterprise, he must have access to state secrets.

Mandatory fulfillment of these requirements is necessary if the organization is obliged to assess the level of qualification of its employees for compliance with prof. standard.

Position Objectives

The purpose of the position of an information security specialist is to ensure the protection of information from external and internal threats, the use of modern means of protection.

The main tasks of a specialist include:

Identification of risks and threats in the field of information security.
Development of protection measures.
Implementation of protection systems.
Monitoring the state of the information security system and preventing violations in its operation.
Development of regulatory documentation in the field of information security.

Requirements for knowledge and skills

requirements of the state legislative framework in the field of information protection;
rules for building information security systems;
criteria by which the level of information protection is assessed;
software and hardware that provide the required level of information protection;
channels of "leakage" of information;
internal regulations for their functional area of activity.

The most sought after skills include:

the ability to timely identify incidents related to the violation of information security;
choose the right ways to respond to emerging incidents;
identify and classify risks in the field of information security;
distribute user access rights and control compliance with the company's requirements by users when working with information;
install specialized software;
identify vulnerabilities in the information security system and eliminate them in a timely manner.

Job Responsibilities

The duties of an information security specialist include several functional areas that should be described in sufficient detail. When describing job responsibilities, it is necessary to systematize information, combining it into blocks according to the functional areas of the employee's work.

: identification of bottlenecks, risk factors, preparation of proposals to increase the efficiency of the system.
Monitoring and diagnosing the operation of information security systems: detection of violations, their identification, preparation of proposals for neutralizing the identified violations and preventing their recurrence.
Administration of information security systems operation: software installation, distribution of access rights for users, monitoring of system performance, fixing system failures, responding to emergency situations in the operation of security systems, setting up and backing up information, determining the rules for storing backups, organizing storage locations and access rules in the data warehouse.
Evaluation of the efficiency of information security systems.
Development of regulatory documentation for information protection, bringing to the attention of employees the rules and requirements for working with information, monitoring the implementation of the rules, identifying violations by personnel of the requirements for working with information, initiating internal investigations into identified violations.
Selection of new means of information protection, testing, implementation of systems, control of their work, evaluation of the effectiveness of protection.

Interaction

An information security specialist works in any employee of the organization who uses software tools in his work and has access to the documentation and information of the enterprise.

The interaction may include tasks that the employee solves daily, communicating with the employees of the organization:

distribution of access rights to the company's information systems;
installation of specialized software on users' computers;
identification of violations in the work with information allowed by employees of the organization;
incident investigation;
introduction of rules for working with information, bringing to the attention of employees the requirements of regulations on information protection.

The video below will tell you about the position of an information protection specialist:

Rights and responsibilities

The Information Security Specialist is responsible for:

safety of enterprise information;
the effectiveness of the built protection;
timely detection of violations in the system;
qualitative elimination of violations and the development of measures to prevent the recurrence of such violations.

The rights granted to an employee should provide him with the opportunity to:

interact with any employee on work issues and require them to comply with information security requirements;
have access to the top officials of the enterprise and inform them about detected violations in the operation of security systems and non-compliance by employees with the rules for information protection;
initiate the introduction of new protection systems.

You can download the DI of an information security engineer, and a specialist -.

Job description of an information security engineer (sample)

In the open spaces, ConsultantPlus unexpectedly found a rather amusing form of a job description for a specialist in ensuring information security in key information infrastructure systems. As an unknown author says, "the form was prepared using legal acts as of 02/03/2014."

Interesting, but sometimes controversial (debatable) provisions. For those who deal with the topic of protecting the KVO, it may be useful to familiarize yourself with the aspen moments, they are further.

name="more">

1.1. This job description defines the functional duties, rights and responsibilities of an information security specialist in key information infrastructure systems _______________ (hereinafter referred to as the Organization).
1.5. An information security specialist in key information infrastructure systems should know:
Laws and other regulatory legal acts of the Russian Federation regulating relations related to the protection of state secrets and other restricted information; regulatory and methodological documents on issues related to information security;
The management, communication and automation structure and the main elements of the Organization's key information infrastructure system;
Access control subsystems, attack detection subsystems, subsystems for protection against intentional influences, information integrity control;
The procedure for creating a secure channel between interacting objects through a public system using dedicated communication channels;
The procedure for performing authentication of interacting objects and verifying the identity of the sender and the integrity of the data transmitted through the public system;
Equipment of the Organization with basic and auxiliary technical means and systems, prospects for their development and modernization;
Prospects and directions for the development of methods and means of technical and software and hardware means of protecting information from destructive information influences;
The procedure for designing and certification of informatization objects; monitoring the effectiveness of information protection at informatization objects;
The procedure for monitoring the use of open radio communication channels;
Methods and tools for identifying threats to information security, methods for identifying information leakage channels;
Methods for conducting scientific research, development on the technical protection of information;
The procedure for examining key information infrastructure systems, drawing up inspection reports, test reports, instructions for the right to operate special means of ensuring information security, as well as regulations, instructions and other organizational and administrative documents;
Powers on information security issues, the possibilities and procedure for using standard technical means of ensuring information security and monitoring their effectiveness;
Methods for analyzing the results of inspections, accounting for violations of information security requirements;
Methodology for preparing proposals, methods and means of performing computational work in the interests of planning, organizing and carrying out work to ensure the security of information and ensure state secrets;
Achievements of science and technology in the country and abroad in the field of technical intelligence and information protection;
Methods for assessing the professional level of information security specialists, certification of specialists;
Basics of labor legislation;
Rules on labor protection and fire safety.
2. FUNCTIONAL RESPONSIBILITIES
Information security specialist in key information infrastructure systems:
2.1. Performs activities to ensure the security of information in key systems of the information infrastructure.
2.2. Identifies possible information security threats, software and hardware vulnerabilities, develops intrusion detection technologies, evaluates and reassesses the risks associated with threats of destructive information impacts that can damage systems and networks due to unauthorized access, disclosure, modification or destruction of information and information resources. control systems.
2.3. Defines restrictions on information input, procedures for managing security incidents and preventing their development, the procedure for connecting to open information systems, taking into account security associated with agreements on access and resource prioritization, requirements for backup storage, processing and copying information, service priorities for use of main and backup telecommunication services (services).
2.4. Develops procedures for protecting information carriers, communications and restoring information and control systems after a failure or failure.
2.5. Carries out control over activities to ensure the security of information in key systems of the information infrastructure; informational, logistical and scientific and technical support of information security; monitoring the status of work to ensure the security of information in key systems of the information infrastructure and their compliance with the regulatory legal acts of the Russian Federation.
2.6. Gives feedback and opinions on projects of newly created and modernized facilities and other developments on the issues of ensuring information security in key information infrastructure systems.
2.7. Participates in the review of technical specifications for research and development work to ensure the security of information in key information infrastructure systems, assesses their compliance with current regulatory and methodological documents.
2.8. Participates in the implementation of new means of technical protection of information.
2.9. Promotes the dissemination of best practices in the Organization and the introduction of modern organizational and technical measures, means and methods for ensuring the security of information in key systems of the information infrastructure.
2.10. Conducts assessments of the technical and economic level and effectiveness of the proposed and implemented organizational and technical solutions to ensure the security of information in key information infrastructure systems.
2.11. Develops lists of personnel access to protected objects, the procedure and rules for the behavior of employees, including when they are moved, dismissed and interact with personnel of third-party organizations.
2.12. Provides leadership and training of personnel to act in crisis situations, including the procedure for the actions of managers and other responsible persons of key information infrastructure systems.

Methods for selecting specialists and rules for maintaining documentation. The strategy of personnel management and the subtleties of labor legislation. As a HR worker, you know firsthand how many skills and knowledge this profession requires.

We also know how complex and multifaceted the tasks of a human resources specialist are. We understand how important it is to receive specialized information in time and in full. We are aware of how difficult it can sometimes be to interpret laws and apply them in practice.

To help you, we have created the official website of the magazine "Handbook of Personnel Officer" - a portal where all the most important professional information is collected.

Registration on Pro-personal.ru is:

About work with personnel and personnel office work - every day.

Operative information about changes in the labor legislation.

Rostrud clarifications, expert comments, analysis of judicial practice.

Practical tips, step by step instructions for all key processes.

The project team consists of experienced experts in the field of personnel management and labor legislation. The result of their work is materials that make work easier. personnel specialists at all stages: from the formation of staff to the preparation of reports and interaction with the GIT.

We strive to create an information space where professional personnel officers will find everything they need to work effectively. In the electronic version of the magazine you will find not only useful articles, but also many services that will greatly facilitate your work. Among them:

Calculators of pension payments, other benefits.

Production calendars with the function of calculating the norms of working hours.

Dispensary schedules.

Use the free demo access to evaluate the information content and practical value of the materials in practice.

Categories

Editor's Choice