Tag Info

New answers tagged

1

http://www.sans.org/security-resources/policies/ Sans has a good set of templates. As far as what/how much to cover. For the first version stick to something very basic. Getting something that can be followed is more important than 100% coverage. Remember that this document is living and updatable. Start with the 5 Ws like reporters do: Who, What, Where, ...


2

I'd imagine that what you're thinking of here is there are several compliance standards which specifically mention the existence of an "information security policy". This is typically a high-level document covering principles of information security to which the organisation subscribes and is signed off by the board/CEO to indicate their commitment to ...


2

Refer to the CISSP manual about security policies, also refer to all the security domains they cover as they should be part of your policy (at a high level). There are also resources like SANS which can provide you with some guidance. Also check this document of GIAC which covers what a good security policy covers. The document you will write will be the ...


6

The basic rules that the big companies follow aren't very much different from the rules/recommendations by popular infosec standards (e.g. ISO27k): Segregation of duties - separation on services provisioning, development process, or any other part of IT services, so different people are responsible for the various components/stages of service delivery, ...


0

Data security policy should be introduced conceptually to the employee before they sign the contract, and explained and/or provided to them in detail before they sit down at their desk for the first time.


3

First, when the employee starts. Not in order for them to learn a lot, but to get the impression that you are taking security seriously, so they don't do anything stupid. Then a week or two later, when the employee has some clue about the job they are doing, and can actually appreciate the security training. Then a while later when they are firmly and ...


1

'Stay aware and alert' is the mantra for information security. As for your question, the awareness should be part of the induction program for new employees. Basic security etiquettes like Not flashing ID cards No scribbling of sensitive information. Governing policies like web access restrictions etc. These are basic policies that need to be put forth ...


36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either. Each ...


16

Do it as part of new employee orientation and follow up with more training at regular intervals. Security policy is part of our new employee orientation. We also require a short online "securing the human" training to be completed once every other year. Introduction of this regular training has had noticable positive results.



Top 50 recent answers are included