Information Security Management Handbook, Volume 5, 6th Edition

288  ◾  Information Security Management Handbook

f. Permitted methods of access and the management and use of user identification (IDs)

and passwords.

g. Security outsourcer’s obligation to keep a list of authorized persons and a corresponding

authorization procedure for user access rights.

2. An outline of the training to be provided for enterprise personnel, including the type and

number of personnel to be trained and the related costs, if training is needed or requested.

3. Established time schedule for receipt and delivery of work products or services.

4. e availability of on-line communications, security related to access controls, transmis-

sions, and alternate data entry considerations.

5. A detailed description of liability ...