Writing Information Security Policies

Staffing Considerations

Policies about staffing direct how the human resources are handled when managing the infrastructures. This includes policies mandating the maintenance of an inventory of key technical jobs and cross-training of personnel. This does not include policies on hiring, performing background checks, and interview procedures. These usually fall under domain of human resource policies. Remember this when your Human Resources Department objects to having this included in an information security policy document. A compromise would be to have this policy under both domains.

Before government employees and government contractors write me nasty letters, this is a broad generalization based on my experience with helping companies ...