What makes up a policy?
An information security policy can be broken down into several parts. The policy must outline the scope of the information, as well as which locations and networks are covered. “Information must be specific to the content included, rather than general. An information security policy must follow management’s directives in determining categories (e.g. legal) and fit within the confines requested by management. It is necessary to include references to supporting documents, as well as information on institution-wide security mandates”, advises Colin Helm, writer at BoomEssays.
How does management view security?
Before you begin writing your policy, speak with management to find out how they define security. As the security professional writing their policy, your most important job is to listen and understand how your client’s management team wants their company information to be secured. To get a proper understanding, you must ask the correct questions. Find out what sorts of information must be protected, what are management’s priorities, and are their types of information that need extra protection in the policy.
Start with a framework
The best place to start when writing an information security policy is with a security industry standards document as a framework. A good example of such a document is Standard of Good Practice. On its own, a framework is not considered a strong policy, but using one as a starting point is seen as a positive by actors such as external auditors. Because these documents are, by their nature, very generic, they must be supplemented with organizationally specific input from management. Merging these two parts is best done by adding the standard document into the client organization’s existing priorities and ethos standards.
Determine your mandates
Properly setting your policy’s mandates is one of the most important steps in writing your policy. These policies work most optimally when they take the form of a short list of mandates that everyone can agree on and abide by. A policy that is too particular and far-reaching cannot function properly as a compliance paper. Without the proper mandates, an information security policy will become riddled with so many exceptions that it will not be able to do its job. After all, the goal with these policies is to have them followed as rigorously as any other policy at the company.
Divide into sub-policies
“Often it becomes necessary to segment an information security policy into sub-policies, usually because the organization is so large. Large companies will have locations all over the globe that have different needs and attributes, and this will necessitate sub-policies to serve these differences properly,” says Emma Harris, a business manager at UK writing. It is crucial that nothing from the main policy is repeated in sub-policies, as this kind of duplication causes serious problems when sub-policies begin to deviate as they are modified over time.
Draw up supplementary documents
There are multiple ways an information security directive can be interpreted. To avoid confusion, it commonly becomes necessary to write up some supplementary documents, instead of writing sub-policies. Supplementary documents include process, procedures, guidelines, technology standards, and roles and responsibilities. Take care when writing your information security policy, as it is an extremely important document that should not contain improper grammar or typos.
Conclusion
Writing an information security policy can seem like a daunting task, but it can be accomplished by following these steps. Find out from management what their goals are, begin with a framework, determine your mandates, divide into sub-policies, draw up supplementary documents, take care when writing and editing, and you will have an effective information security policy.
