What policies and agreements regarding information security are a must have for every self respecting company?

Question

I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. What kind of documents should be considered?

For example (specifically):

1. Responsible disclosure policy
2. Privacy policy
3. Password policy
4. Clean-desk policy
5. Non-disclosure/confidentiality agreement
6. BYOD policy

Or more general:

1. General terms
2. Information policy
3. Information security policy

What about right-to-audit, EU cookie-law and right-to-be-forgotten? And for example a document/form were someone needs to sign for getting a physical key of a building? In what documents should that be described and what other things should be considered?

Answer 1

I want to begin my answer by saying I work in IT Audit / Security and this answer derives from my profession.

I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security.

This is not only a good idea but essential to protecting your workplace. The benefits for implementing a enterprise IT Security policy are numerous, such as those listed below:

1. User accountability
2. Protection from liability
3. More effective protection of company data and corporate assets

Users accountability is greatly increased as no longer can users say "there is no policy" or "I did not understand / know we had a policy" The liability of the company is somewhat mitigated due to the presence of management responsibility as sign off on these policies would imply. Finally, policies and accompanying procedures set a consistent, reliable method through which information security is implemented at the company.

As to what to include in such an policy, the items you have listed are good for start but are not adequate for the modern workplace. Essential policies would include among others... but these in my view are more critical.:

1. Incident response
2. Business continuity and Disaster Recovery

To implement any of these policies, you must have business and management buy in. Without commitment from the top, policies have no teeth. In the end, IT security is essential, but ultimately serves as a way to meet business objectives. IT cannot survive on its own isolated.

Answer 2

The need of creation and capturing acknowledgement of the policies depend upon various factors like present or expected to be done in future compliance audit, logging etc. The policies that any organization should take into consideration will be as below

1. acceptable use policy
2. change management policy
3. critical technology usage policy
4. data retention policy
5. database credentials policy
6. Information sensitivity policy
7. Information security policy
8. Information protection policy
9. Password policy
10. Acceptable encryption policy
11. Compliance specific policies

Then there would be procedures and documents like

1. Change control procedure
2. Disaster recovery plan
3. Configuration standards
4. Incident response procedure etc.

Here the target audience and frequency of acknowledgement will vary based upon the roles and responsibilities assigned to individuals and business requirement behind having these in picture in first place ex. Password policy, information security policy is for everyone and needs to be signed annually or upon considerable modification however incident response plan or disaster recovery plan is applicable for only the people who need to be engaged in the countermeasure activity.

Hope this helps.