We are required to write an "information security policy" for our company, and I want to know how much should we cover, and if there are any template or examples that would help.
closed as too broad by Graham Hill, AviD♦ Jul 28 '15 at 10:21
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Refer to the CISSP manual about security policies, also refer to all the security domains they cover as they should be part of your policy (at a high level). There are also resources like SANS which can provide you with some guidance. Also check this document of GIAC which covers what a good security policy covers.
The document you will write will be the governing policy, it means it will cover a high level of requirements per security domain. Each domain should then implement the security in a technology agnostic standard (which covers specific details about the domain) and then a technology specific baseline. E.g. a network standard is implemented in a baseline for Cisco IOS Routing, Cisco IOS Switching, Juniper Routers, ...
I'd imagine that what you're thinking of here is there are several compliance standards which specifically mention the existence of an "information security policy". This is typically a high-level document covering principles of information security to which the organisation subscribes and is signed off by the board/CEO to indicate their commitment to addressing Information Security issues. It's also used to form the basis of lower level policies which should implement specifics of the principles laid out in the top-level document.
In terms of getting some samples for this kind of thing, I'd recommend looking at the ISO27000 series of documents and people offering services around that as typically the Infosec policy will be a part of any ISO27001 documentation set.
Something like this shows the kind of content you would typically see in that kind of document, although the specifics would depend on your organisation/industry etc.
http://www.sans.org/security-resources/policies/ Sans has a good set of templates.
As far as what/how much to cover. For the first version stick to something very basic. Getting something that can be followed is more important than 100% coverage. Remember that this document is living and updatable.
Start with the 5 Ws like reporters do: Who, What, Where, When, Why. Who does this policy apply to? (Employees, contractors, guests, etc...) What does this policy apply to? (desktops, servers, services, byod, etc...) Where is this policy enforced? (What location do you do business including DR sites, hosting facilities, etc...) When is this policy enforced? (is the a time window, is it enforced for employees from start till they leave employment, if they have byod devices what polices extend after hours, etc...) Why does this policy exist? (This should be first but lay out the reason for the policy, a revision process for the policy, who owns it, and a mandatory review period. I suggest every year unless needed sooner).