I've recently been tasked with putting together a security policy for a small startup firm consisting of ~30 people in the UK. Largely up until now there has been nothing concrete in place, however as we're looking to take on clients in the financial and banking services sector this needs to change.

Having very little security experience (I'm a software engineer by day); and working on a very tight deadline, I'm hoping that there are off the shelf templates/guides I can use to aid in drafting this policy. Additionally what would one expect to see in a robust security policy i.e. one a financial service firm might be happy with?

  • What kind of security policy? Secure development methodology, secure working processes, IT security policy, physical security policy, or all of the above? Notice that SANS has a lot of different policy types!
    – Polynomial
    Commented Jul 24, 2012 at 15:18
  • All of the above!
    – dbotha
    Commented Jul 24, 2012 at 15:19

3 Answers 3


As Eric said in his answer, the SANS site has a great set of security policy templates. BERR, a UK government department, also wrote an excellent document[PDF] that gives some great structural advice for creating security policies.

I can also offer you the following advice:

  • Ask your employees for input when creating the policies. Can they see areas of their work that might be hindered by a particular rule? Can they think of things that you've forgotten?

  • Identify what you're trying to protect. If your answer is "the network", you're not thinking hard enough. What assets are important to you? Source code is an obvious one, but SSL certificate private keys, design documents, financial information, purchase orders, etc. are all important to your success.

  • Security policy should be combined with a usage policy. Some people dislike this, but it's important to get the right context. The security policy essentially boils down to what a user can and cannot do, and what the should and should not do. Usage is an important extension of this.

  • Security policies often get bogged down in what isn't allowed. Don't forget to include exceptions, and a list of things you feel are acceptable (e.g. "browsing semi-NSFW web comics / funny cat picture sites is fine during lunch hours, as long as you know they're reputable and won't perform drive-by browser exploits").

  • Don't try to come up with exhaustive lists when a "within reason" clause could be used instead. This allows you to treat things on a case-by-case basis. Expect your employees to find a good balance, and be responsible.

  • Include sections of text that explain why a policy is in place. Format these sections differently, e.g. with a lightly shaded background, and explain at the beginning of the document that these sections are not considered a binding part of the policy.

  • Policy is about humans, so make it human-readable. For all intents and purposes, lawyers are not human. Just because your document is written in simple, informal language, does not mean that it isn't legally binding or serious. There's absolutely no need for huge blocks of scary legalese in block capitals, exclaiming that "VIOLATIONS OF THE SECURITY POLICY WILL RESULT IN THE EMPLOYEE BEING FIRED OUT OF A CANNON ONTO THE MOON TO GO LIVE WITH WILLZYX AND TOM CRUISE".

  • Perhaps most importantly, don't write anything you wouldn't want to agree to yourself. Furthermore, stick to the security policy yourself. If a staff member sees you violating the very security policy you made them sign, your authority is worth zero and the policy is worth zero.

  • Forgive my naivety, I've been doing a lot of searching and I'm wondering how the ISO/IEC 27000-series fits into all of this? Should we be aligning our security functions with standards in this series. If so which ones should we look into. Is it possible to seek accreditation?
    – dbotha
    Commented Jul 25, 2012 at 16:56
  • The ISO/IEC 27000-series is essentially a security standard in of itself, focusing on secure storage and handling practices, as well as secure methodologies. I'm not sure you need to be 100% compliant as a small company, since the scope of it is massive. However, it's certainly worth reading through and understanding it. I'm sure there are ways to get accredited, but I've never looked into them.
    – Polynomial
    Commented Jul 26, 2012 at 10:16
  • "Security policy should be combined with a usage policy." What exactly is the difference between a security policy and a usage policy? Commented Jun 15, 2015 at 14:03
  • @JohnnyUtahh There's certainly overlap on the Venn diagram, but they're not the same. A usage policy governs how employees should conduct themselves when using IT systems (e.g. no naughty images via work internet access). A security policy also has elements of conduct (e.g. no dodgy sites, cracked software) but is usually much larger in scope, such as giving procedures and contact information for security incidents, and may be broader in scope than just IT (e.g. handling of physical media, documents, etc.)
    – Polynomial
    Commented Jun 15, 2015 at 14:08
  • Thanks @Polynomial, that's helpful. fyi, a couple of links in your above post are broken/obsolete. Commented Jun 15, 2015 at 16:49

I would highly recommend looking into the SANS site for security policy templates. They are fairly simple policies but would be a very good starting point for you all. When I worked at a university, I used these as a starting point and once I got the basics out of the way, I then started looking at other university's policies so I could compare and contrast what they had to what I had. Once you start comparing to your peers, that will let you know what others will expect from you all.


In addition to Polynomial's excellent answer, I've been seeking "pre-packaged in one complete document or template" solutions for more-general policies/coverage and have thus far found:

Health-care and/or Compliance focused:

These "pre-packaged in one document" solutions potentially offer a shorter, easier path to implementation (to serve the tight deadline purpose) than compiling something from a collection of templates or documents.

I welcome comments on any additional, similar sources. If possible I'll add them to the above list.

Collection of templates and related materials:

The following provides a list of in-use policies for (mostly) well-known organizations: Where are some Security Policies that are actually in use?

(Moderator: please mark this post as 'community wiki' if it's appropriate.)

  • I've "forked" this answer/discussion to here, and I may "move" my above answer there. Commented Jun 15, 2015 at 23:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .