Executive Summary
When done well, security policy sets the tone and direction for how the organization will protect its critical information assets. An effective policy life cycle starts with a credible, well-defined foundation, actively engages key stakeholders, includes a policy exception process, requires regular policy review and update, uses innovative and targeted forms of communication, and calls for tracking and reporting key performance measures.
In this podcast, Paul Love, Director of Information Security for The Standard, discusses how to put an information security (IS) program in place that reflects management's intent – and gets users on-board and engaged.
Why Security Policy Is Critical
Security policies are generally viewed as an underdog or necessary evil.
Security policy, determined by senior management, sets the tone for the entire IS program. In effect policy serves as their voice to the organization on expected minimum requirements.
A clear statement of policy allows management to own this. It then allows the CISO and his or her staff to serve as consultants to the organization instead of being viewed as the ones trying to drive the program.
Sources of Security Policy Requirements
Policy requirements derive from:
It is easier to start with a well-recognized, vetted standard than with selecting topics from scratch. Using such a source lends credibility to the initial set of topics you select.
One cautionary note: You need to make sure that any standards you use as a starting point match your business needs and regulatory requirements.
Tailoring is accomplished by close collaboration with key stakeholders in the organization, such as your legal office.
A Business Leader's Role and Responsibilities
Business leaders are responsible for:
As the CISO or Director of IS, focus on the people and process aspects of IS policy by:
While discussing policy during annual planning processes or during performance reviews may be helpful, it works better if security is not specifically called out or highlighted. It should be treated as part of corporate values, part of day-to-day business and the right thing to do – versus being treated as an event.
Policy Structure: Procedures, Standards, and Guidelines
When developing a policy structure, it is important to target the right document to the right internal customer and break each topic into digestible chunks.
Policy at the highest level should be short, concise, and have a lengthy shelf life. It is a simple statement from management of their intent, stating the top-level control objective.
Such statements need to be technology-independent given how rapidly technology changes.
Standards spell out the compulsory, actionable requirements that support policies. Standards are generally used by the IS team and other subject matter experts.
Guidelines are generally non-compulsory best practice recommendations, provided for cases where there is a need to exceed minimum requirements.
Procedures provide step-by-step implementation instructions. They are very detailed, prescriptive, and technology-dependent. Procedures are expected to change frequently.
Security Policy Life Cycle
An effective security policy life cycle includes the following process steps:
Make sure you have defined a policy exception process. This is often overlooked but is critical due to changing business conditions and regulatory requirements.
At the end of the year, present policy exceptions to management so they can determine if such exceptions call for a change in policy.
Keep Users Current on Their Policy Responsibilities
While email and other forms of passive communication have their place, communication about policy needs to be constant, relevant, and engaging.
One recommendation is to conduct training that describes how users should protect themselves and their personal information at home – something that they care about. This is easy for people to understand and grab on to.
Generally people who implement practices at home will transfer these habits into their work environment.
Another effective awareness-raising approach is to create digests of specific policy information that are relevant for specific roles – such as system administrators, software developers, and remote employees.
Supplement this information with banner ads on your internal website, annual online multi-media training, and targeted emails with interesting messages.
Measure Policy Effectiveness
As CISO or Director of IS, you need to understand (i) where deviations from policy are occurring and (ii) the root cause for the deviations. For example:
Another useful measure is tracking the number and type of policy exceptions, and which exceptions were approved by management.
A less tangible, but no less useful, measure is tracking how often users seek your advice, offer suggestions, and ask for policy interpretations.
Resources
CERT, in particular CERT's governance portal and CERT's Virtual Training Environment (search on "policy")