Five Ways to Create High Quality Security Policies

Security policies are the foundation of an enterprise information security program.

Without a solid foundation in place you simply cannot build a sturdy long-lasting structure; be it a building or a security program.

Below are five things that can help you ensure your foundation is strong.

1. Use a framework

By starting with a trusted framework you can avoid reinventing the wheel. A framework like ISO2700x will provide you with the areas you need to cover in your policies. Then it's your job to customize the policies so they fit your environment.

2. Make sure your policies are readable to non-technical folks

A policy is a strategic statement. It is not meant to give the details on what technology will be used, or how it will be implemented.

If you include too much detail you run the risk of making an unreadable document. A good policy can be read and understood by anyone in the organization. Leave the technical-speak for your standards and procedures.

3. Get executive buy-in

Board or senior leadership buy-in is critical to a security program. Some standards (such as GLBA) even require Board sign off on security policies.

By getting the organization's senior leadership on-board we ensure that security will have the funding, personnel and support it needs to succeed.

The senior leaders do not need to be an active part of the policy creation, but they should approve of the completed policies so they can understand and support them.

4. Communicate your policies

Too many organizations create a set of security policies, only to see those policies sit on a server, unread by anyone outside the groups who created and approved them.

Policies should be communicated widely throughout the organization. Security awareness training is the most obvious way to educate employees about the security policies, but topical posters, relevant emails, and on-going reminders at staff meetings can be effective and cost effective as well.

5. Maintain your policies

Organizations are dynamic. What worked for you in 2008 probably doesn't work in 2010. And what works for us here in 2010 will most likely not work in 2012.

As such, keeping policies up to date is a crucial task for organizations. A regular schedule should be created for reviewing and updating policies as appropriate.

Ideally, policies should be reviewed quarterly. But it should be no less than annually.

High quality policies aren't the whole story. We also need structure through quality standards, and detailed procedures, but without the foundation your program doesn't have a chance for success.

Give your security policies the time and resources they need.

Cross-posted from Enterprise InfoSec Blog from Robb Reck 

Note: the views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post. Infosec Island reserves the right to remove or edit the content of all material submitted by our members.

View the original article here