Week 2: Administrative Controls

SE578 – Prof. Joseph Constantini

By David Truong (D00571438)

1/18/2013

Table of Contents

How do Administrative Controls demonstrate “due care?” 3

How does the absence of Administrative Controls impact corporate liability? 3

How do Administrative Controls influence the choice of Technical and Physical Controls 4

How would the absence of Administrative Controls affects prigects in the IT department 4

Summary 5

Reference 6

How do Administrative Controls demonstrate "due care?" Administrative Controls are guidelines that is set up by management in order to meet the standard that shows that how he company has taken precaution to prevent malicious intent as well as prevention against malicious intent. The controls that are implemented must show a degree in which the process is common and assist in the fortifying the company’s ability to prove its willingness to take action on correcting weaknesses within the company. This idea is also known as “due care.” They must include controls that contribute to individual accountability, ability to audit, and separation of duties. Administrative Controls can be identified with two specific category: detective administrative controls and preventative administrative controls. Ultimately, the purpose of Administrative Controls is to show that the company has taken the necessary precaution, the “due care,” to protect the confidentiality, integrity and availability of the company’s assets and consumer’s information.
How does the absence of Administrative Controls impact corporate liability? In the absence of Administrative Controls, there can be serious liability implication that can affect the company in the legal sense. Much of the legality can be traced to The Sarbanes-Oxley Act, Title IV section 404 which “requires all publicly traded companies to