This is a collection of documents and links to web pages that are relevant to the topics discussed at the ESAF meeting, which was held February 13, 2006, at the Fairmont in San Jose, CA. All of the materials have been recommended by the Program Committee or ESAF participants. This page is intended as a resource for all ESAF participants to capture the valuable information that was shared at the meeting, as well as any related reports or studies that senior executives in information security would find useful.

Proceedings from the 2006 ESAF Meeting
The ESAF meeting offers a unique opportunity to gain valuable insights from other senior security executives. In a closed setting of select participants, the discussions provide a wealth of information that is directly applicable to your work, can be used to help formulate your strategy, and advance your information security program. As requested by ESAF participants, we have captured your discussions in these proceedings, to serve as a valuable reference.

New FBI Computer Crime Survey
Study based on responses from a cross-section of more than 2,000 public and private organizations in four states. It provides insight into the cyber attacks that U.S. organizations are facing, the defenses they're using, and the implications for industry and government. Released in January 2006.

National Survey on Data Security Breach Notification
By Ponemon Institute, Sponsored by White and Case LLP
Study based on survey of individuals who had been notified about a data security breach, which asked them questions about the content and the process of the notification. It includes an analysis of how much the incident affected the customers' trust and confidence in the organization and customer churn. Published in September 2005.

Recommended Practices on Notification of Security Breach Involving Personal Information
By Joanne McNabb, Chief Office of Privacy Protection, California Department of Consumer Affairs
As part of the breach notification law in California, the Office of Privacy Protection was statutorily mandated to make recommendations to organizations for providing notice in cases of security breach involving personal information.

CSIA Legislative Update
A document by the Cyber Security Industry Alliance (CSIA) which provides the current status of the privacy, identity theft, and data protection bills in Congress. For each bill, it includes title, sponsors, and a summary of the proposed legislation. Released February 1, 2006.

Convergence of Enterprise Security Organizations
A study commissioned by ASIS International (ASIS), Information Systems Audit and Control Association (ISACA) and Information Systems Security Association (ISSA) which looks at the integration of traditional and information security functions in a growing number of U.S.-based global companies. Study was done in November 2005.

Cyber Security: A Crisis of Prioritization
Developed by the President’s Information Technology Advisory Committee (PITAC), this report underlines the need for the Federal government to fundamentally improve its approach to cyber security.

Data Classification Documents
This collection of documents is intended to help security executives in developing their data classification strategy. They contain samples of an information classification scheme, data classification standards, business partner agreement, and records retention policy.