Writing Information Security Policies

Publishing and Notification Requirements of the Policies

After the policies have been written, they will not do your organization any good if they sit on the shelf collecting dust. Not only should it be a living document, but it also should be accessible to all users. A common way of doing this is to publish the policies on the organization’s intranet. This way, not only are the policies available to all users, but your organization will save on printing costs—and updates can be made in one central location without having to ensure they are distributed.

Policies in this area should cover both the publishing of the policy documents and notification of when published. This policy also should cover who is responsible for these acts. Many organizations ...