Now imagine you are an IT manager in our example accounting software firm, and the CEO storms into your office, announcing, We ve nearly won a contract with Central Government, but they ve found out that we don t have a security policy or a security officer. So you are the new security officer. Write me a policy.

Hopefully, after reading the explanation in the previous section, you know enough to say, Thanks for the promotion, Boss. Actually, we need a full security strategy. These government auditors don t mess around, so we need to do it properly. But what is properly?