Information Assurance Handbook: Effective Computer Security and Risk Management Strategies

CHAPTER 12

Information Assurance Policy

The information assurance policy is undoubtedly the most important element for a successful information assurance management program. In the same way that it is unthinkable that a country could function without laws and legislations, it is unthinkable that an organization could operate without information assurance policies.

Establishing the IAMS starts with identifying information assets and associated life cycles. This is followed by a risk identification and assessment exercise on the assets that provides a sound basis to develop and implement controls to manage the risks. A successful risk assessment exercise is also important in that it gives the correct foundation to formulate the information assurance ...