Security Policies and Implementation Issues, 2nd Edition

CHAPTER 14

IT Security Policy Enforcement

THE ENFORCEMENT OF IT SECURITY POLICY begins when the hard work of creating the policy and providing initial security awareness is done. All the effort put into creating the policy is of little value if it’s not followed. A compliance program is essential to ensure that policies are adopted and deliver intended value. Quality assurance and quality control reviews (sometimes referred to as compliance reviews) and vulnerability assessments are three important components of a compliance program.

A quality assurance (QA) review ensures that the security policy is adopted before an action is taken. For instance, ensuring that security is properly coded before a piece of software is moved to production ...