Security in Computing, Third Edition

8.3. Organizational Security Policies

A key element of any organization's security planning is an effective security policy. A security policy must answer three questions: who can access which resources in what manner?

A security policy is a highlevel management document to inform all users of the goals of and constraints on using a system. A policy document is written in broad enough terms that it does not change frequently. The information security policy is the foundation upon which all protection efforts are built. It should be a visible representation of priorities of the entire organization, definitively stating underlying assumptions that drive security activities. The policy should articulate senior management's decisions regarding security ...