We are required to write an "information security policy" for our company, and I want to know how much should we cover, and if there are any template or examples that would help.
4
-
Note that they don't want us to write specific policies such as Password policy or business continuity Policy– user78389Jul 28, 2015 at 4:41
-
1This is quite broad. Even without a password policy or BC, are you talking about what resources can use and how? How sensitive data must be handled, and what constitutes sensitive data? There's just so much here that can be (and should be) covered in an Information Security policy.– user79537Jul 28, 2015 at 4:48
-
we already have a BC and Password policy, but they are asking for another document "information security policy" and we don't know what is the coverage of this document– user78389Jul 28, 2015 at 5:14
-
1Who are "they", and what is the context in which they are asking to see your Information Security policy?– Graham HillJul 28, 2015 at 8:24
Add a comment
|
3 Answers
Refer to the CISSP manual about security policies, also refer to all the security domains they cover as they should be part of your policy (at a high level). There are also resources like SANS which can provide you with some guidance. Also check this document of GIAC which covers what a good security policy covers.
The document you will write will be the governing policy, it means it will cover a high level of requirements per security domain. Each domain should then implement the security in a technology agnostic standard (which covers specific details about the domain) and then a technology specific baseline. E.g. a network standard is implemented in a baseline for Cisco IOS Routing, Cisco IOS Switching, Juniper Routers, ...
answered Jul 28, 2015 at 5:15
I'd imagine that what you're thinking of here is there are several compliance standards which specifically mention the existence of an "information security policy". This is typically a high-level document covering principles of information security to which the organisation subscribes and is signed off by the board/CEO to indicate their commitment to addressing Information Security issues. It's also used to form the basis of lower level policies which should implement specifics of the principles laid out in the top-level document.
In terms of getting some samples for this kind of thing, I'd recommend looking at the ISO27000 series of documents and people offering services around that as typically the Infosec policy will be a part of any ISO27001 documentation set.
Something like this shows the kind of content you would typically see in that kind of document, although the specifics would depend on your organisation/industry etc.
answered Jul 28, 2015 at 8:58
http://www.sans.org/security-resources/policies/ Sans has a good set of templates.
As far as what/how much to cover. For the first version stick to something very basic. Getting something that can be followed is more important than 100% coverage. Remember that this document is living and updatable.
Start with the 5 Ws like reporters do: Who, What, Where, When, Why. Who does this policy apply to? (Employees, contractors, guests, etc...) What does this policy apply to? (desktops, servers, services, byod, etc...) Where is this policy enforced? (What location do you do business including DR sites, hosting facilities, etc...) When is this policy enforced? (is the a time window, is it enforced for employees from start till they leave employment, if they have byod devices what polices extend after hours, etc...) Why does this policy exist? (This should be first but lay out the reason for the policy, a revision process for the policy, who owns it, and a mandatory review period. I suggest every year unless needed sooner).
