What is the difference between an IT security policy, an information security policy and a cyber security policy?

2 Answers 2


These terms have been used synonymously over the years, but in practice, they are starting to get differentiated.

IT Security policies tend to cover secure policies around the "information technology" itself, the systems that serve and process information. Servers, networks, etc. In some organisations, there would be nothing about end users in these policies and only the IT staff would read them, for instance.

Information Security policies are about the wider security of information, no matter what form that takes. So, that would include paper copies of data in warehouses, as well as databases, cloud services, etc.

Cyber Security policies is the newer term, and tend to cover the information that is served and processed for/by the public and 3rd parties in a digital form. Basically, any data that travels over the Internet. "Internet security" used to be the term used, but that got confused with just user security awareness and how to browse safely, so this other more generic term has gained popularity in use. I am unaware of any formal definition of "cyber", but this is how it is used in practice. Some older information security professionals still roll their eyes at the use of this buzzword in official documents.

But, an organisation can define their terms however they choose to. These policies will include some section explaining what the policy covers, its scope, and where it applies.


All of these terms are used somewhat interchangeably.

Cyber Security and IT Security I would view as the same thing. That being protecting computer systems from illicit access, modfication of operation and/or damage.

Information Security is the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information.

The major differences -

  • Information security is not limited to computing. Securing physical copies of information is also required - for example making sure staff don't leave confidential documents in the pub opposite the office.
  • Information security doesn't cover systems damage and control manipulation. For example Stuxnet modifying control routines in centrifuges to cause physical damage.

For computing systems which hold confidential data the two are heavily intertwined.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .