Start with Security Policies

Policies represent the corporate philosophy of an organization. They provide staff the direction and support needed to perform their day-to-day duties. In the case of information security, an information security policy helps provide direction in accordance with business requirements, standards, laws, and regulations.

Policies should be established in line with business objectives. For example, management demonstrates support for and commitment to information security through the issuance and maintenance of an information security policy.

Leading organizations use an information security policy to define information security and establish the framework for setting control objectives within the organization. Security controls help protect the organization's sensitive information and intellectual property. Unfortunately, many businesses use an ad-hoc approach to securing information, installing firewalls, anti-virus software, and other controls without a top down planned approach to managing risks.

Security controls include administrative, technical, and physical mechanisms to manage risks. Security policies are essential to an effective security system and express management’s direction and guidance to implementing, maintaining, and improving an information security management system. Security policies include access controls, managing passwords, patch management, monitoring systems, business continuity, compliance, and many other areas.

Security controls often consist of the following:

• Policy – the rules and requirements for risk management and continuing business operations.
• Standards – detailed networking and security technologies for protecting information systems.
• Guidelines – system or topic related recommendations and best practices.
• Procedures – details to implement standards and guidelines, guides for installing software, securing facilities, documenting security breaches, etc.

In some instances, policies can conflict with each other. In these circumstances, a steering committee can address policy conflicts and identify appropriate compromises and alternative solutions.

If your organization lacks policies, security policy templates provide a jump start and help you manage your risks.