Policies, Standards, Procedures – Information Security Governance Documents
Information Security Governance documents consist of Policies, Standards, and Procedures.
- Policies are top-level governance documents that inform the organization of executive management’s information security direction and goals.
- Standards are just below policies and define the activities and actions as baselines needed to meet policy goals.
- Procedures are the lowest level documents and provide direction on how to meet security directives and activities, example; a step-by-step checklist (Grama, 2015, pg.398-399).
Examples of common security policies include: Internet Usage policy, Email Usage Policy, and a Password Policy.
A Security Policy typically contains the following elements:
- Overview that explains the elements of the policy and what it covers in broad terms.
- Purpose statement that provides a definition of appropriate use of internet services in an organization.
- Scope statement that specifies what elements are covered by the policy, and who it applies to.
- Policy. This can include elements such as resource usage, allowed usage, and personal usage. Additional elements could include for example prohibited and allowed usage of the internet.
- Policy compliance.
- Related standards and policies.
Other elements contained in policies of this nature often include: publically accessible internet connected information, monitoring, confidentiality, company image, company materials, and web site creation using organization assets (SANS internet policy, 2013).
The University of Georgia provides a password policy with the following elements:
- Overview.
- Objective / Purpose.
- Scope.
- Policy standard which includes the following elements:
- Minimum Password Length.
- Password Composition.
- Password Management.
- Password Storage.
- Password Aging.
- Password Reuse.
- Password Sharing and Transfer.
Other elements of the policy include: Electronic Transmission, Password Requirements for System Administrators and Developers, Enforcement, and Exceptions (University of Georgia Password Standard, n.d.).
References
Grama, J. L. (2015). Legal issues in information security (2nd ed.). Boston, MA: Jones & Bartlett Learning.
SANS internet policy. (2013). Internet usage Policy. Retrieved June 14, 2016, from https://www.sans.org/security-resources/policies/retired/pdf/internet-usage-policy
University of Georgia Password Standard. (n.d.). Password Policy. Retrieved June 14, 2016, from http://eits.uga.edu/access_and_security/infosec/pols_regs/policies/passwords/password_standard/
