82 Managing Network Vulnerability Assessment
General Program Policy
A general program policy sets the strategic directions of the enterprise for
global behavior and assigns resources for its implementation. This includes
such topics as information management, conflict of interest, employee stan-
dards of conduct, and general security measures.
Topic-Specific Policy
Topic-specific policy addresses specific issues of concern to the organization.
Topic-specific policies might include e-mail usage, Internet usage, phone
usage, physical security, application development, system maintenance, and
network security.
System- or Application-Specific Policy
System- or application-specific policies focus on decisions taken by manage-
ment to protect a particular application ...