TABLE OF CONTENTS A security policy needs to spell out guidelines for security activities in an organization. It should
Justify both direct and indirect expenditures on security by stating the importance of network security to the organization.
Indicate the scope of the security efforts, as well as any legal requirements.
Specify security personnel, their job responsibilities, and organizational structure.
Describe secure behaviors that all employees must use.
Lay out procedures for reporting and handling security violations.
Describe the organization s disaster recovery plan.
Notice that the preceding list doesn t include any details of how security will be implemented. The detailed implementation plan is left to the IT staff person in charge of security. Given that security technologies are constantly changing (and hopefully, being improved), it makes sense to keep implementation specifics such as the name of a specific hardware or software product out of a policy document.
A security policy should also avoid including the names of individuals so that you don t need to revise the policy whenever personnel change. Instead, refer to job titles (for example, CSO, or Chief Security Officer ) when describing human responsibilities.
Because developing a security policy is a difficult process, your organization may decide to purchase a set of templates (cost ? $600) or use free templates available at http://www.sans.org/resources/policies/#template rather than starting from scratch.
A security policy can be a lengthy document. Many organizations break their policy into a collection of smaller documents, each of which addresses a...
