Writing Information Security Policies

Summary

1. Security policies

   • Are distinct from guidelines and standards.

   • Are distinct from procedures and control.

   • Describe security in general terms; they do not describe how to implement.

2. Policies are important to

   • Assure proper implementation of control.

   • Guide product selection and development process.

   • Demonstrate management support.

   • Avoid Liability.

   • Achieve consistent and complete security, avoiding fragmented efforts.

3. Policies should be developed

   • Before security problems occur.

   • To avoid liability.

   • After a security breach.

   • To document compliance and demonstrate quality control processes (for example, ISO 9001).

4. Policies should be developed by

   • Setting the scope and objectives for the policy document.

   • Defining what policies need to be written. ...