1

What is the difference between an "Information Security Policy" and a "Cybersecurity Strategy"?

I had an argument about this with my management and whilst some think that its basically the same thing, others were adamant that the policy is different to the strategy.

Improve this question
2
  • 1
    A "Cybersecurity Strategy" is very high level. A good strategy will include having the organization maintain an Information Security Policy as a part of the strategy.
    – John Deters
    Jul 22, 2016 at 13:22
  • 1
    you can easily argue all day because neither term is concretely defined in everyone's mind.
    – dandavis
    Jul 22, 2016 at 17:07

2 Answers 2

Reset to default
4

There is a massive difference between "Information Security Policy" and a "Cybersecurity Strategy". As the name suggests they are policies and strategies respectively and the management often gets confused between the both. However I believe following points will help explaining the difference.

An information Security policy is an individual document which will:

  1. Enumerate the elements that constitute IT security or information security.

  2. Explain the need of IT security.

  3. Categorize the various types of IT data, i.e. equipment, and processes subject to this policy.

  4. Indicate, in broad terms, the information security responsibilities of the various roles in which each member of the organization may function.

  5. Indicate appropriate levels of security through standards and guidelines.

Where as a Cybersecurity Strategy will comprise of But not limited to

  1. Information Security Policy

  2. Information Sensitivity Policy

  3. Incident Response and Disaster Recovery Plans

  4. Change control procedure

  5. Configuration Standards

  6. Many more policies, guidelines, standards etc which will collectively contribute in how the organization will anticipate/respond to a Cybersecurity threat/incident.

I do understand that some of the elements will be highlighted in Information Security Policy but looking at the bigger picture not everything will be covered. Hope this helps in anyway.

Improve this answer
2
  • 2
    There is also a temporal aspect and a difference in audience: the policy describes the situation and responsibilities as they currently exist to all parties in and prtners of an orgamization: the strategy incorporates the planned goals and a general metod for acheiving those. The strategy is pitched at the decision makers and staff who will implement the policy. (In my experience)
    – symcbean
    Jul 22, 2016 at 19:13
  • @symcbean perfect. The audience varies depending upon roles.
    – GhostSpeaks101
    Jul 23, 2016 at 6:54
0

Information security spans people , process and technology. In considers all aspects of information security including clean desk policy, physical and other aspects. Cyber us a subset of information security focused on digitsl aspects. We mix the two but there is a difference

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .