Managing A Network Vulnerability Assessment

Policy Review (Top-Down) Methodology 87

Items 5 (when) and 6 (why) are not usually considered part of the policy

text. When a policy is in effect it is normally addressed in the transmittal

document. When the policy is published, there is a document that goes with

the policy that explains why the policy was developed and when it takes

effect. Policies should not contain explanations as to why they were developed

or a compliance date.

When assessing the policies, procedures, and standards that support the

network environment, it is most important that there be some written and

published documentation. Look to see what is there. Read the documents and

then, during your interviews, ask the interviewees how they interpret the

policy. Use this information ...