I'm a bit unsure how to answer this question. I've looked online however I'm unsure if I'm answering the right way.

Your organisation has an e-mail server that processes sensitive emails from senior management and important clients. What should be included in the security policy for the email server?

I was looking at secure the chat mail, secure the transmission, etc. Would that be the correct way to answer it?

  • 1
    What level/layer of policy? Technical? Managerial? Is this a corporate policy or a policy to be technically enforced on the system? – schroeder Mar 1 '19 at 20:16
  • So I messaged and effectively was told that it would just be an overview. So maybe give an example of technical, physical and administrative. Not too sure what the corporate ones are. Was sent, similar to this: policy.security.harvard.edu – User0110101 Mar 2 '19 at 0:25
  • Ok, then what is being asked is a corporate, managerial policy: "senior management says 'do this'". – schroeder Mar 2 '19 at 14:35

Policy statements need to be tied to risks. Each policy statement is a control to reduce a risk to the organisation.

So, in this scenario, you need to identify the risks to the organisation and to determine what high-level controls should be in place to reduce those risks.

A good policy needs to make a difference between a policy ("strategy") and procedures ("tactics"). A policy should not specify how to do something, but what the approach is to gain a desired outcome. That way the policy can be applied no matter what the technology is. This can be a very difficult line to walk and many policies blur this line in practice.

So, from a high-level, outcome-based perspective, how should the organisation approach the email server given that it processes sensitive emails?

There are many corporate email policies online for you to use as inspiration. Writing information security policies is an art and getting practice is a very good thing.

  • 1
    “Policy statements need to be tied to risks.” What a great quote! Well-put @schroeder. – securityOrange Mar 2 '19 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.