It is a very well known fact that all organizations require written policies, procedures, and rules in order to achieve compliance. Think about a practical example of building a house. For any solid structure to be developed, you need a solid foundation. The policies are the foundation of an organization. Policies are the principles and guidelines that are defined and approved in order to guide decision-making and ensure that consistent action is taken.
A security policy, or more commonly known as an IS (Information Security) Policy, is a policy framework that is in place to cover end-to-end security aspects of a company or organization. This policy includes guidelines and definitions for a variety of IT security concerns.
A good approach to an IS policy is to see it as the ‘CEO’ of policies. Included in the policy are high-level considerations for many aspects of the organizational environment. The granular detail is often not included in the IS policy itself, but rather defines the focus areas at a high level, and then makes reference to the respective policies which define the specific details.
Information security is essential to an organization’s business because it helps to (1) maintain a reliable service, (2) achieve and maintain security compliance with various laws and regulations in the countries in which an organization operates in, (3) protect an organization’s clients and their information, (4) comply with customers’ and regulators’ security requirements, and (5) manage and reduce risk to an organization’s activities.
Depending on the region you operate in, customer you operate with, or type of service/product provided, you may have to comply with certain regulations such as GDPR, CCPA, LGPD, or POPI. It would be good to disclose this within the policy and stipulate the responsibility undertaken by your organization to ensure compliance with these regulations.
Asset ownership and classification regards being aware of the organizational assets (to ensure they are appropriately protected) in order to enforce and assign accountability to the responsible personnel within the organization to ensure safeguarding of these assets. Classification typically includes four (4) levels – Public, Internal Use, Confidential and Restricted. For each type of classification, there should be a definition describing how to define the level, as well as procedures surrounding the use, disclosure, and distribution of such assets/ asset information.
Critical to any organization is the ability to ensure continued operation of critical business functions in the event of a disaster. A DR Plan will identify the recovery objectives, the structure for implementation, mitigation measures, and the communication process to keep staff, partners, and the public informed of necessary changes to service delivery. It is recommended that this is included at a high level in an IS Policy, and referenced to the DR-specific policy.
Other potential items/ focus areas to include in an IS Policy would be: Access Considerations, Incident Response, Communication, Physical Access, Security Training & Awareness, and others.
Ultimately, an information security policy sets out to define and enforce process requirements that will govern and drive the availability, confidentiality, and integrity of the organization’s information security as a whole.
The above focus areas are included as a guideline, and many other focus areas can be included, or excluded depending on the organization, audience, type of service/product, requirement for security, regulatory requirements, and more.
Scytale is able to provide end to end guidance on creating the IS policy relevant to your organization, as well as the implementation of all related processes and tools, in order to ensure alignment and enforcement of the requirements stipulated in the policy itself.
