The IA Process - Information Assurance Architecture - page 58

he business environment is the business type, business services, and workflow.
The business may be a service organization, manufacturing, retail, etc. Business ser-
vices include activities that fulfill expectations for service requestors. The workflow
is how those business services are fulfilled.
he technical environment includes data/information, systems and applications,
and technical infrastructure.
3.3.2.2 Environment as Seen from the IA 2 F Views
he IA 2 F people view of environment includes culture, laws, government, customs,
norms, relationships, labor force availability, personnel safety, and comfort. The
IA 2 F policy view addresses compliance requirements for the environment (e.g.,
Occupational Safety and Hazard Agency [OSHA] requirements) as well as enter-
prise guidance for other environment characteristics. The IA 2 F business process
view includes workflow with respect to environment, that is, assists to discover
risks associated with environment that may affect business processes (i.e., interrupt
operations). The IA 2 F systems and applications view includes software application,
databases, and system processes, and new systems versus effect on existing com-
mon work environment. The IA 2 F data/information view addresses new data and
effects on old data in transit, at rest, and in use. The IA 2 F infrastructure view of
environment looks at the data center, power requirements, existing power capac-
ity, uninterrupted power supply (UPS) requirements, operating systems, network
bandwidth, and capacity planning. Table 3.4 continues the RFID example.
3.3.3 Define the Scope
3.3.3.1 Establish the Connection of the
Solution to Strategic Goals
With a good understanding of the environment, the next step is to determine what
characteristics about the environment are in scope. Define scope in terms of breadth
and depth. Breadth of scope covers things like the number of people, the number
of business processes, and the remainder of the IA 2 views with respect to variety
and quantity. Depth of scope covers the attributes of people or business processes,
systems and applications, etc. For example, attributes of people may include identi-
fication, privilege, role, education level, training, expertise, and experience. Part of
the IA 2 Process is to discern how much depth is necessary to achieve the IA 2 intent.
The fact that people are included in the IA 2 Process at all is part of the question in
determining scope breadth. The attributes or characteristics about the people are a
question of scope depth. The same considerations apply to the other IA 2 views. The
IA 2 views assist in defining the scope. Table 3.5 provides guidance for determining
scope breadth and depth; Table 3.6 provides examples of scope.