Paper 1
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 1/38
6
Creating Effective Information Security Policies
We haven’t the time to take our time.
Eugene Ionesco, 1912–1994
When organizations first recognize that they need to ensure
that the information assets of the organization are adequately
protected, this usually results in asking the question, “What
applicable policies are in place?” There may be some human
resource policies that might apply or corporate policies noted
in the ethics and compliance code of conduct, however, these
are normally insufficient to address the breadth of the infor-
mation security needs. The next step is for the organization to
embark upon the time-consuming task of developing informa-
tion security policies.
Why Information Security Policies Are Important
To the seasoned information security practitioner, asking why
information security policies are important may seem like a
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 2/38
question with an obvious answer. The question is not so obvi-
ous to the end users of the organization, as many of them may
feel that if everyone applies common sense, there is no need
for them to read and sign off on voluminous sets of policies.
The reality is that each person has a different interpretation
of what is common sense. For example, leaving a scruffy old
backpack containing books in a car may seem like a reason-
able act to one employee who wonders why would anyone
want to steal a bag full of books. Another employee might
think that because of the condition of the backpack, no one
would want to steal it. Another might think that their car is
parked in broad daylight in a heavily traveled area, which
would make the risk of stealing it quite low. Another em-
ployee may think that the car alarm would be a sufficient de-
terrent from anyone wanting to go through the trouble of
stealing the backpack.
Then along comes the information security officer, whose
job it is to evaluate the course of action that will provide rea-
sonable security. The security officer knows the stories of
break-ins all too well, and knows that criminals do not know
for sure what is in the backpack. The criminal might assume
that there is a laptop, money, or credit cards that could be sold
for a nominal amount to buy drugs, alcohol, or support rudi-
mentary living expenses. Thus, the opportunity and motiva-
tion presents an unacceptable risk that must be mitigated. The
organization cannot afford to leave these individual decisions
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 3/38
up to the common sense internal barometer of thousands of
employees. The organization must set forth advice or a base-
line of what behavior is expected for each employee, and not
leave this up to individual discretion. This advice, and ex-
pected behavior, is manifested through a set of information
security policies. The policies form the cornerstone of the in-
formation security program and are representations of
management’s intention that are needed to control the infor-
mation security assets.
Avoiding Shelfware
Although information security policies are very important,
they can easily become shelfware if their development, man-
agement, and distribution are not handled appropriately.
Countless security departments have filled binders full of poli-
cies over the years that remain unread and require frequent
dusting. As the Intranet-based environments started to take
hold in the mid-’90s, these environments moved from paper-
based shelfware to electronic-based shelfware. The security
department may have had a large project to develop the infor-
mation security policies, place them on the Intranet, and then
they were “done.” Lengthy, technical documents with all the
technical jargon may have sounded impressive to the security
department, but fail when end users are required to read
them because they are not understandable. Who would read
these lengthy documents? The same individuals that would
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 4/38
read the complete car owners manual after purchasing a new
car before they put the key into the ignition—in other words,
a very small segment of the population. The security policies
should be written in a language from the user and be brief
enough to get the point across without overwhelming the end
user. More detailed descriptions can be placed in standards
documents that the users can read if they need additional in-
formation. An organization security policy beyond 30 to 60
pages is normally much more than would be required by any
medium- to large-sized organization. Beyond that level, the
policies are likely to go unread.
Electronic Policy Distribution
To avoid shelfware in electronic policies, they need to be kept
(1) brief, (2) updated, and (3) relevant. Web-based policies
should each be no more than two online pages to get the point
across as to what is expected (Fitzgerald, 2004). Resumes are
kept to two pages for a reason—people stop reading them if
they have not received what is needed within the first two
pages. Daily online articles on sites such as Yahoo and USA
Today are no more than two pages, as the reader may lose in-
terest after that.
The policies need to be updated at least annually to ensure
that the management direction is still desired. As employees
comes across a policy that was last updated 4 years ago, they
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 5/38
may make the conclusion on their own that the policy no
longer applies. The organization may have gone through a
merger, and the conflicting policies may exist for the two or-
ganizations or worse yet, if the policies have never been inte-
grated, the employees of the acquired company may make the
erroneous assumption that they should still follow their old
company policies and may not be aware of the new acquiring
company policies.
Policies need to maintain their relevancy to remain effec-
tive. For example, if an organization has not addressed the use
of social media in their policies, the management and end
users will have to rely on the existing policies to determine
whether social media is acceptable. Or, suppose an employee
just purchased an iPad tablet computer, but the policy indi-
cates that no personal desktop or laptop computers may be
used within the company. Should the iPad be allowed?
Technically, according to the policy, the iPad “tablet” computer
has not been addressed, and the associate may leave it to an
interpretation more favorable to the employee as to whether
to use the device.
Policies posted online should always ensure that the revi-
sion history is provided as well, so that users can see what
changes were made to the documents and also determine if
they are looking at the correct version. Even with many com-
panies moving toward green, environmental-friendly initia-
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 6/38
tives to reduce wasteful printing and disposal costs, many end
users still prefer to have a paper document that can be refer-
enced when needed. The revision update date and history
help ensure that the correct document is being utilized.
Several security vendors have products that will provide an
electronic distribution of security policies and also provide a
mechanism for end users to confirm that they have read, ac-
cepted, and understood the policy contents. The results are
then recorded in a database that can be queried as needed.
This information becomes very useful during incident investi-
gations, terminations, and lawsuits where the company wants
to demonstrate that the employee had clear knowledge of the
policy and chose to violate it against the corporate policy.
Canned Security Policies
Consulting organizations have sets of policy templates that are
used to jumpstart a client’s need for information security poli-
cies. These are then tailored to the needs of the organization.
This process may be more effective than writing the informa-
tion security policies from scratch, as long as the policies meet
the compliance, laws, regulations, and desires of the organiza-
tion. It is not unusual to see where an organization has imple-
mented a copied policy verbatim, sometimes even forgetting
to change the company name on the template. During the
2010 BP oil spill, it was revealed that the business
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 7/38
continuity/disaster recovery documents from several major
oil companies appeared to have used the same templates for
their disaster recovery plans (Gupta, 2010). Although develop-
ing the complete information security policy is beyond the
scope of this book, there are several information security
books available with sample polices that can be used to jump-
start the development. Two very good sources are Information
Security Policies and Procedures—A Practitioner’s Reference
(Peltier, 2007) and Information Security Policies Made Easy by
Information Shield (Wood, 2009). Both of these sources contain
valuable information at a fraction of the cost of a security con-
sultant for one day.
Policies, Standards, Guidelines Definitions
Organizations typically do not have a consistent understand-
ing as to what a “policy” is. This seems like such a simple con-
cept, so why the difficulty? The reason is not the lack of un-
derstanding that a policy is meant to govern the behavior
within the organization. The reason for the confusion has
more to do with the fact that in the interest of saving time, or-
ganizations will combine policies, procedures, guidelines, and
standards into one document and call it the policy. This is not
really a time saver because it makes it more difficult by intro-
ducing inflexibility into the policy each time the policy needs
to change. This is similar to denormalizing a database struc-
ture to make the performance more efficient, when in fact it
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 8/38
becomes harder to add new data elements to a particular ta-
ble without redesigning the table. The policies and procedures
end up getting fused together, and so when the procedure
changes, the policy document by default is changing as well
when the policy does not need to change. Or, the employees
begin to think that the procedure is the only way the policy
can be implemented, when there may be multiple procedures
across the organization that are implemented to comply with
the policy. For example, an organization might have a policy
that all systems need a full backup weekly and they need to be
maintained off site. The data center may have a procedure
that ensures that tape backups are taken weekly and the tapes
are picked up by a vendor and transported to the secure off-
site storage. The midrange server infrastructure team may
have a procedure to ensure that full backups are taken weekly
through the online data vaulting process, in addition to the
daily incremental backups at the remote site. The desktop sup-
port department may have a procedure that ensures that com-
pany critical information is stored on network drives, also
subject to the weekly online backup process. In this case, each
area has designated local procedures that ensure that they are
in compliance with the higher-level corporate policy.
Policies Are Written at a High Level
Policies should be written at the highest level possible to still
be able to communicate the intentions of the company. The
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 9/38
higher the level of the policy, the more likely the policy is able
to stand the test of time. Companies do not want to be reissu-
ing policies on a frequent basis unless they have to. This in-
volves resources for development and, more important, the
time and expense of each person to reread the complete pol-
icy. Whereas changes in technology, company structure, laws
and regulations, emerging trends, and so forth warrant
changes to the security policy, frequent changes due to minor
technology changes are not desired. The reaction of most
users will be, didn’t we just do this? For example, if password
standards are written into the password policy for a primarily
Windows-based environment, what happens when a Unix
server for the SQL server data warehouse project is intro-
duced? Will the password policy need to be redistributed and
attested to by thousands of users, when the change impacted
only a small number of users?
Security officers and their teams are charged with the re-
sponsibility of creating the security policies. The policies must
be written and communicated at a level that is understood by
the end users of the organization if there is to be any chance
of compliance. If the policies are poorly written or written at
too high of an education level (common industry practice is to
focus the content for general users at the sixth-to eighth-grade
reading level), the policies will not be understood.
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 10/38
Whereas security officers may be charged with the develop-
ment of the policies, the effort is normally a collaborative ef-
fort to ensure that the business issues are addressed.
Utilization of an security council, executive oversight commit-
tee, or a subgroup of that committee, depending upon the pol-
icy being drafted, is an approach that considers the business
impacts of a security policy decision. Developing the policies
solely within the information technology department and
then distributing the policies without business input is likely
to miss important business considerations. As always, decid-
ing on the appropriate security controls is a decision of risk by
the organization, which ultimately should be decided by the
business leaders. The organization is also more likely to ac-
cept security policies that have been approved and endorsed
by the business leaders versus the security officer or the infor-
mation technology department.
Once these different documents have been created, the ba-
sis for ensuring compliance is established. These deliverables
form the basis for organizational compliance with the security
policies. The most current versions of the documents need to
be readily accessible by those that are expected to follow
them. Many organizations have placed these documents elec-
tronically on their intranets or shared file folders to facilitate
communication of the most current documents. Placement of
these documents plus checklists, forms, and sample docu-
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 11/38
ments can save time for the individual and be an added value
provided by the security department.
Policies
Policies define what at a high level the organization needs to
accomplish and serves as management’s intentions to control
the operation of the organization to meet business objectives.
The why should be stated in the form of a policy summary
statement or purpose. If end users understand the why, they
are more apt to follow the policy. As children, we were told
what to do by our parents and we just did it. As we grew
older, we challenged those beliefs (as 4- and 5-year-olds and
again as teenagers) and needed to understand the reasoning.
The rules had to make sense to us. Today’s organizations are
no different; people need to understand the why before they
can really commit.
Security Policy Best Practices
Someone once said, “Writing security policies is like making
sausage. You don’t know want to know what goes into it, but
what comes out is pretty good!” Writing policies does not have
to be a mystery, and there are several guidelines for creating
good security policies practiced in the industry.
Clearly define policy creation practice—A clearly defined
process for initiating, creating, reviewing, recommending,
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 12/38
approving, and distributing the policies communicates the
responsibilities of all parties necessary and the time expec-
tations of their participation. This can be accomplished by
process flows, swim lanes, flowcharts, or written
documentation.
Write policies to survive 2 to 3 years—Policies are high-level
statements of the objectives of the organization. The under-
lying methods and technologies to implement the controls
to support the policies may change. By including these in
the other related documents (procedures, standards, guide-
lines, and baselines), the policy statements will need less
frequent change. This avoids frequent updates and subse-
quent distribution to the organization.
Use directive wording—Policies represent expectations to be
complied with. As such, statements such as must, will, and
shall communicate this requirement versus using weaker
directives such as should, may, or can. This latter type of
language is better reserved for guidelines or areas where
there are options.
Avoid technical implementation details—Policies should be
written to be technology independent, as the implemented
technology may change over time.
Keep length to a minimum—Policies published online should
be limited in length to two to three pages maximum per
policy. The intent for the policies is for the end user to un-
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 13/38
derstand and not to create long documents for the sake of
documentation.
Provide navigation from the policy to the supporting docu-
ments—If the implementation of the policy is placed online,
then hyperlinking the procedures, standards, guidelines,
and baselines can be an effective method to ensure that the
appropriate procedures are being followed. Some of the in-
ternal security procedures would not be appropriate for
general knowledge, such as the procedure for monitoring
intrusions or reviewing log files, and these need to be acces-
sible by the security department and properly secured from
general distribution.
Thoroughly review before publishing—Proofreading policies
by multiple individuals can catch errors that may not be
readily seen by the author.
Conduct management review and sign off—Senior manage-
ment must endorse the policies if they are to be effectively
accepted by all management levels and subsequently the
end users of the organization.
Avoid techno speak—Policies are oriented to communicate
to nontechnical users. Technical jargon is acceptable in
technical documentation but not in high-level security
policies.
Review incidents and adjust policies—Review of the security
incidents that have occurred may indicate the need for a
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 14/38
new policy, a revision to an existing policy, or the need to
redistribute the current policy to reinforce compliance.
Periodically review policies—A formalized review process
provides a mechanism to ensure that the security policies
are still in alignment with the business objectives.
Develop sanctions for noncompliance—Effective policies
have consistent sanction policies to enable action when the
policies are not followed. These sanctions may include “dis-
ciplinary action up to and including termination.” Stronger
language can also be added for prosecution for serious
offenses.
Policies provide the foundation for a comprehensive and ef-
fective security program. The company is protected from sur-
prises and gives the necessary authority to the security activi-
ties of the organization. By communicating the company poli-
cies as directives, accountability and personal responsibility
for adhering to the security practices is established. The poli-
cies are utilized in determining or interpreting any conflicts
that may arise. The policies also define the elements, scope,
and functions of the security management.
Types of Security Policies
Security policies may consist of different types, depending
upon the specific need for the policy (NIST, 2003). The differ-
ent security policies work together to meet the objectives of
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 15/38
the comprehensive security program. Different policy types
include:
Organizational or program policy—This policy is issued by a
senior management individual who creates the authority
and scope for the security program. The purpose of the pro-
gram is described and the assigned responsibility is defined
for carrying out the information security mission. The goals
of confidentiality, integrity, and availability would be ad-
dressed in the policy. Specific areas of security focus may be
stressed, such as the protection of confidential information
for a credit card company or heath insurance company, or
the availability focus for a company maintaining mission-
critical, high-availability systems. The policy should be
clear as to the facilities, hardware, software, information,
and personnel that are in scope for the security program. In
most cases, the scope will be the entire organization, how-
ever, in larger organizations the security program may be
limited in scope to a division or geographic location. The or-
ganization policy sets out the high-level authority to define
the appropriate sanctions for failure to comply with the
policy.
Functional, issue-specific policies—Although the organiza-
tional security policies are broad in scope, the functional or
issue-specific policies address areas of particular security
concern requiring clarification. The issue-specific policies
may be focused on the different domains of security and
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 16/38
address areas such as access control, contingency planning,
segregation of duties principles, and so forth. They may also
address specific technical areas of existing and emerging
technologies, such as use of the Internet, e-mail and corpo-
rate communication systems, wireless access, or remote
system access. For example, an acceptable use policy may
define the responsibilities of the end user for using the cor-
porate computer systems for business purposes only, or
may allow the person some incidental personal use pro-
vided the restrictions of ensuring usage is free from viruses,
spyware, downloading inappropriate pictures or software,
or sending chain letters through e-mail. These policies will
depend upon the business needs and the tolerance for risk.
The policies contain the statement of the issue, the state-
ment of the organization’s position on the issue, the applica-
bility of the issue, compliance requirements, and sanctions
for not following the policy.
System specific policies—Areas where it is desired to have
clearer direction or greater control for a specific technical
or operational area may have more detailed policies. These
policies may be targeted for a specific application or plat-
form. For example, a system-specific policy may address
which departments are permitted to input or modify infor-
mation in the check writing application for the disburse-
ment of accounts payable payments.
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 17/38
The more detailed and issue specific the policy, the higher
likelihood that the policy will require more frequent changes.
Typically, high-level organizational security policies will sur-
vive for several years, whereas those focused on the use of
technology will change much more frequently as technology
matures and new technology is added to the environment.
Even if an organization is not currently utilizing a technology,
policies can explicitly strengthen the message that the tech-
nology is not to be used and is prohibited. For example, a pol-
icy regarding removable media such as USB drives, or one re-
garding the use of wireless devices or camera phones in the
workplace, would reinforce the management intentions
around the acceptance or nonacceptance of these devices.
Standards
Whereas policies define what an organization needs, the stan-
dards take this a step further and define the how. Standards
provide the agreements that provide interoperability within
the organization through the use of common protocols.
Standards are the hardware and software security mecha-
nisms selected as the organization’s method of controlling se-
curity risks. Standards are prevalent in many facets of our
daily lives, such as the size of the tires on automobiles; specifi-
cations of the height, color, and format of the stop sign; and
the wiring details of the RJ11 plug on the end of the phone
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 18/38
jack cable. Standards provide consistency in the implementa-
tion as well as permit interoperability with reduced confu-
sion. There are many security standards that could be chosen
to implement a particular solution. For example, when select-
ing a control for remote access identification and authentica-
tion, an organization could decide to utilize login IDs and
passwords, strong authentication through a security token
over dialup, or a virtual private network (VPN) solution over
the Internet.
Standards simplify the operation of the security controls
within the company and increase the efficiency. It is more
costly to support multiple software packages, which do essen-
tially the same activity. Imagine if each user was told to go to
the local computer store and purchase the antivirus product
that they liked the best. Some users would ask the sales
person’s opinion, some would buy the least expensive to meet
their budget needs, and others might get the most expensive
assuming this would provide the greatest protection. Without
a consistent product standard for antivirus products, the orga-
nization would be unsure as to the level of protection pro-
vided. Additionally, each of these different products would
have different installation, update, and licensing considera-
tions contributing to complex management. It makes much
sense to have consistent products chosen for the organization
versus leaving the product choice to every individual.
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 19/38
Determination of which standards meet the organization’s
needs must be driven by the security policies agreed by man-
agement. The standards provide the specification of the tech-
nology to effectively enable the organization to become suc-
cessful in meeting the requirements of the policy. If in the ex-
ample of the remote access the organization was restricting
information over the Internet or had many users in rural ar-
eas with limited Internet access, then the VPN standard over
the Internet may not be a plausible solution. Conversely, for
end users transmitting large amounts of information, the dial-
up solution may be impractical. The policy defines the bound-
aries within which the standards must be supportive.
Standards may also refer to those guidelines established by
a standards organization and accepted by management.
Standards creators include organizations such as the National
Institute of Standards and Technology (NIST), International
Organization for Standardization (ISO), Institute of Electrical
and Electronics Engineers (IEEE), American National
Standards Institute (ANSI), and National Security Agency
(NSA).
Procedures
Procedures are step-by-step instructions in support of the poli-
cies, standards, guidelines, and baselines. The procedure indi-
cates how the policy will be implemented and who does what
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 20/38
to accomplish the tasks. The procedure provides clarity and a
common understanding to the operation required to effec-
tively support the policy on a consistent basis. Procedures are
best developed when the input of each of the interfacing areas
are included in the development of the procedure. This re-
duces the risk that important steps, communication, or re-
quired deliverables are left out of the procedure.
Companies must be able to provide assurance that they
have exercised due diligence in the support and enforcement
of company policies. This means that the company has made
an effort to be in compliance with the policies and has com-
municated the expectations to the workforce. Having docu-
mented procedures communicated to the users, business part-
ners, and anyone utilizing the systems as appropriate, mini-
mizes the legal liability of the corporation.
Creating documented procedures is more than a documen-
tation exercise for the sake of documentation. The process it-
self creates a common understanding between the developers
of the procedure of the methods used to accomplish the task.
Individuals from different organizational units may be very
familiar with their work area but not as familiar with the im-
pact of a procedure on a department. This is the “beach ball
effect,” where organizations sometimes appear as a large
beach ball, and the individuals working in different depart-
ments can only see their side of the beach ball and may not
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 21/38
understand the other parts of the organization. The exercise
of writing down a single, consistent procedure has the added
effect of establishing agreement between the parties. Many
times at the beginning of the process, individuals will think
they all understand the process, only to come to understand
that people were really executing different, individual pro-
cesses to accomplish the task.
Consistent documentation of the procedures permits the
ability to improve the procedures. Once everyone under-
stands the initial procedure, enhancements can be applied
and communicated to everyone. This provides a method to in-
corporate the best thinking on the single procedure versus
having multiple procedures for the same operation with a
mixture of good and bad practices.
Baselines
Baselines provide descriptions of how to implement security
packages to ensure that implementations are consistent
throughout the organization. Different software packages,
hardware platforms and networks have different methods of
ensuring security. There are many different options and set-
tings which must be determined to provide the desired protec-
tion. An analysis of the available configuration settings and
subsequent settings desired form the basis for future, consis-
tent implementation of the standard. For example, turning off
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 22/38
the telnet service may be specified in the hardening baseline
document for the network servers. A procedure for exceptions
to the baseline would need to be followed in the event that the
baseline could not be followed for a particular device, along
with the business justification. The baselines are the specific
rules necessary to implement the security controls in support
of the policy and standards, which have been developed.
Testing of the implemented security controls on a periodic
basis assures that the baselines are implemented according to
the documented baselines. The baselines themselves should
be reviewed periodically to ensure that they are sufficient to
address emerging threats and vulnerabilities. In large envi-
ronments with multiple individuals performing systems ad-
ministration and responding to urgent requests, there is an in-
creased risk that one of the baseline configurations may not
be implemented properly. Internal testing identifies these vul-
nerabilities and provides a mechanism to review why the con-
trol was or was not properly implemented. Failures in train-
ing, adherence to baselines and associated procedures, change
control, documentation, or skills of the individual performing
the changes may be identified through the testing.
Guidelines
Guidelines are discretionary or optional controls used to en-
able individuals to make judgments with respect to security
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 23/38
actions. A good exercise is to replace the word guideline with
the word optional. If by doing so, the statements contained in
the “optional” category are what is desired to happen at the
user’s discretion, then it is an appropriate guideline. If on the
other hand, the statements are considered as required to ade-
quately protect the security of the organization, then this
should be defined as part of a policy, standard, or baseline.
Guidelines are also those recommendations, best practices,
and templates provided by other organizations such as the
Control Objectives for Information and Related Technology
(COBIT), the Capability Maturity Model (CMM), ISO 17799,
British Standard 7799, security configuration recommenda-
tions such as those from the NIST or NSA, organizational
guidelines, or other governmental guidelines.
Combination of Policies, Standards, Baselines, Procedures, and Guidelines
Policies, standards, baselines, procedures, and guidelines are
closely related to each other and may be developed as the re-
sult of new regulations, external industry standards, new
threats and vulnerabilities, emerging technologies, upgraded
hardware and software platforms, or risk assessment
changes. Sometimes these different areas are combined into
single documents for ease of management of all the docu-
ments. Keeping policies separate from the implementation
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 24/38
components (standards, baselines, and procedures) increases
the flexibility and reduces the cost of maintenance as the poli-
cies typically change less frequently than the supporting pro-
cesses to achieve compliance with the policy. The relation-
ships between the policies, standards, baselines, procedures,
and guidelines and the laws and regulations providing the re-
quirement to implement these governing activities is shown
in Figure 6.1.
Figure 6.1 Relationships between policies, standards, procedures, baselines, and guidelines.
Policy Analogy A useful analogy to remember the differ-
ences between policies, standards, guidelines, and procedures
is to think of a company that builds cabinets, which has a
hammer policy. The different components may be as follows:
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 25/38
Policy—”All boards must be nailed together using company-
issued hammers to ensure end product consistency and
worker safety.” Notice the flexibility provided to permit the
company to define the hammer type with changes in tech-
nology or safety issues. The purpose is also communicated
to the employees.
Standard— “Eleven-inch fiberglass hammers will be used;
only hardened-steel nails will be used with the hammers;
automatic hammers are to be used for repetitive jobs >1
hour.” Technical specifics are provided to clarify the expec-
tations that make sense for the current environment and
represent management’s decision.
Guideline—”To avoid splitting the wood, a pilot hole should
be drilled first.” The guideline is a suggestion and may not
apply in all cases or all types of wood. This does not repre-
sent a requirement, but rather a suggested practice.
Procedure—”(1) Position nail in upright position on board.
(2) Strike nail with full swing of hammer. (3) Repeat until
nail is flush with board. (4) If thumb is caught between nail
and board, see Nail First-Aid Procedure.” The procedure in-
dicates the process of using the hammer and the nail to
clarify what is expected to be successful. Following this pro-
cedure, with the appropriate standard hammers, and prac-
ticing guidelines where appropriate, will fulfill the policy.
Analogies such as this can be effective when leading the
team to develop security policies to ensure that they are on
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 26/38
the same wavelength and not mixing policies, procedures,
standards, and guidelines. These can also be useful in security
awareness training to indicate when a particular user should
refer to a policy, standard, procedure, or guideline.
An Approach for Developing Information Security Policies
Let us assume for a moment that the guidance in the preced-
ing sections were followed, and the organization now has a
set of information security policies that are easy to read, kept
current, and generally available in a nice format on the Web.
However, if no one seems to be reading them or following
them, what could be the problem? Many times the root cause
is a lack of management support. How could this be? After all,
if the information security officer has been designated with
the role of developing and distributing information security
policies, why would there be a low acceptance rate? The an-
swer usually lies in the fact that while the information secu-
rity officer may have done an excellent job researching and
developing security policies, the same diligence was not ap-
plied in ensuring that the rest of management was on board
with the policies prior to rollout. The security officer may de-
cide to push out the policies once his department has devel-
oped them. As such, the policies become those “owned” by the
security officer and not the rest of the management. These are
then treated as departmental policies that have no greater en-
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 27/38
forcement requirements than the policies and procedures that
are created by their organizational area. Then, when there is a
conflict between the departmental desires and the security
policy, the departmental desires win. For example, if an orga-
nization has to get information quickly to a customer, it can
fax or e-mail the information as part of its normal procedure.
However, the information security policy may require that all
transmissions over an open network, as in the case of e-mail,
or that only the transmission of all confidential information
be encrypted with the most stringent government standard
encryption, such as Federal Information Processing Standard
(FIPS) 140-2 encryption requirements. The department send-
ing the information may have a disagreement with the secu-
rity department on the information classification of “confi-
dential” in the information security policy, or may feel that
the requirement is a bit over the top and does not agree with
the policy at all, as it would hamper the speed of doing busi-
ness and cause inferior relationships with customers. Who is
right? In this case, neither; the security officer failed to obtain
agreement with the policy before the procedures were exe-
cuted and the executive from the other department is incor-
rect in not adhering to the policy. Unfortunately, this situation
is all too common. The good news is that this can be avoided
by following a different approach to developing and distribut-
ing the security policies.
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 28/38
Utilizing the Security Council for Policies
Management support is essential in the development of infor-
mation security policies. So, how is that attained? One method
that is very effective is to form a security committee, also
known as an information security council as introduced in
Chapter 4. The security council can review the policies pro-
posed by the information security department. The benefits of
this approach are (1) consensus of the policies are first built at
the front-line supervisor/middle management/technical staff
level, (2) senior management has greater comfort that the
policies will be accepted by the organization as the manage-
ment team has reviewed them before approval, and (3) it
builds grassroots ownership of the information security poli-
cies. Although the information security council can also serve
as oversight for other security initiatives, serve as a sounding
board, and prioritize information security efforts, it can be es-
pecially effective in vetting and discussing the information
policies that are needed by the organization.
The Policy Review Process
Now that the organization has identified an individual re-
sponsible for the development and implementation of secu-
rity policies the security council has been created, and an un-
derstanding of what makes a good policy has been communi-
cated, there needs to be a process for reviewing the policies.
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 29/38
This process may be developed during the creation of the se-
curity council. What is important is that the policy develop-
ment process is thought out ahead of time to determine who
will (1) create, (2) review and recommend, (3) approve the fi-
nal version, (4) publish, and (5) read and accept the policies.
The time spent in this process, up front, will provide many div-
idends down the road. Many organizations jump right in and
someone in the security department or information technol-
ogy department to draft then email the policy without taking
these steps. Proceeding along that path ends up with a policy
that is not accepted by the organization’s management and
thus will not be accepted by the organization’s end users.
Why? Because the necessary discussion, debate, and accep-
tance of the policies by the leaders of the organization never
took place. In the end, the question of management commit-
ment again surfaces, when there was never a process in place
to obtain the commitment.
The process could be depicted in a swim-lane-type chart
showing the parties responsible, activities, records created
through each activity, and decision boxes; or a flowchart for-
mat. Senior management will want this presented at a high
level, typically no more than one to two pages of a process dia-
gram. The process will vary by organizational structure, geo-
graphic location, size, and culture of decision making.
However, a successful process for review should contain the
following steps, as depicted in Figure 6.2.
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 30/38
Figure 6.2 Security council policy development, approval, and distribution process.
1. Policy needs to be determined—Anyone can request the need
for a policy to the information security department.
Business units may have new situations that are not cov-
ered by an existing security policy. If no security policies ex-
ist in the organization, the information security department
needs to take the lead and establish a prioritization of poli-
cies that are necessary.
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 31/38
2. Create, modify existing policy—The information security de-
partment creates an initial draft for a new policy that can
be reacted to. Caution must be taken not to copy and dis-
tribute these policies taken from books or Internet sources
as is as they may not be completely appropriate, enforce-
able, or supported by procedures within the organization.
3. Internal review by security department—People within the
security department will have varying levels of technical
expertise, business acumen, and understanding of the orga-
nizational culture. By reviewing within the team first, many
obvious errors or misunderstandings of the policy can be
avoided before engaging management’s limited review
time. This also increases the credibility of the information
systems security department by bringing a quality product
for review. It also saves time on minor grammatical reviews
and focuses the management review on substantive policy
issues.
4. Security council reviews and recommends policy—This is ar-
guably the most critical step in the process. This is where
the policy begins the acceptance step within the organiza-
tion. The policies are read, line by line, during these meet-
ings and discussed to ensure that everyone understands the
intent and rationale for the policy. Management’s commit-
ment begins here. Why? Because the management feels like
part of the process and have a chance to provide input, as
well as thinking about how the policy would impact their
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 32/38
individual departments. Contrast this method with just
sending out the policy and saying “this is it” and the differ-
ence becomes readily apparent. These are the same man-
agement people that are being counted on to continue to
support the policy once it is distributed to the rest of the
workforce. Failing in this step will guarantee failure in hav-
ing a real policy.
If we buy into the notion that a security council is a good
practice, logical, practical, and appears to get the job done,
what is the downside? Some may argue that it is a slow
process, especially when senior management may be push-
ing to “get something out there to address security” to re-
duce the risks. It is a slow process while the policies are be-
ing debated. However, the benefits of (1) having a real pol-
icy that the organization can support, (2) buy-in from the
management on a continuing basis, (3) reduced need to re-
work the policies later, and (4) increased understanding by
management of the policies’ meanings and why they are
important outweigh the benefits of blasting out an e-mail
containing policies that were copied from another source,
the name of the company changed, and distributed without
prior collaboration. Policies created in the later context
rarely become “real” and followed within the organization,
as they were not developed with thorough analysis of how
they would be supported by the business in their creation.
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 33/38
5. Information technology steering committee approves policy
—A committee made up of the senior leadership of the or-
ganization is typically formed to oversee the strategic in-
vestments in information technology. Many times these
committees struggle with balancing decisions on tactical
firefighting on short term issues versus dealing with strate-
gic issues, and this perspective needs to be understood
when addressing this type of committee. The important ele-
ment in the membership of this committee is that it in-
volves the decision leaders of the organization. These are
the individuals that the employees will be watching to see if
they support the policies that were initially generated from
the security department. Their review and endorsement of
the policies is critical to obtain support in implementing the
policies. Also, they may be aware of strategic plans or fur-
ther operational issues not identified by middle manage-
ment (through the security council) that may make a policy
untenable.
Since time availability of the senior leadership is typically
limited, these committees meet at most on a monthly basis,
but more typically on a quarterly basis. Therefore, suffi-
cient time for planning policy approval is necessary. This
may seem to run counter to the speed at which electronic
policies are distributed. However, as in the case with the se-
curity council review, the time delay is essential in obtain-
ing long-term commitment.
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 34/38
6. Publish policy—Organizations that go directly from step 2 to
this step end up with shelfware, or if e-mailed, “electronic
dust.” By the time the policy gets to this step, the security
department should feel very confident that the policy will
be understood by the users and supported by management.
Users may agree or disagree with the policy, but will under-
stand the need to follow it because it will be clear how the
policy was created and reviewed. Care must be taken when
publishing policies electronically, as it is not desirable to
publish the same policy over and over with minor changes
to grammar and terminology. Quality reviews need to be
performed early in the development process so that the se-
curity council and information technology steering commit-
tee can devote their time to substantive issues of the policy
versus pointing out the typos and correcting spelling. End
users should be given the same respect and should expect
to be reviewing a document free from error. The medium
may be electronic but that does not change the way people
want to manage their work lives. With the amount of e-mail
already in our lives, we should try to limit the amount of
“extra work” that is placed upon the readers of the policies.
The Web-based policy management tools provide the facili-
ties to publish the policies very quickly. Since tracking of
reading the policies is a key feature of these products, once
the policy is published, they typically cannot be changed
unless a new policy is created! This has major implications
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 35/38
for the distribution of the policy. This means that any
change made will require the republishing of the policy.
Imagine thousands of users in the organization that now
have to reread the policy due to a minor change. This situa-
tion should be avoided with the review process in place in
the preceding steps. The electronic compliance tracking
software is usually built this way (and rightly so), so that it
is clear which policy version the user actually signed off on.
It should be clear by now that even though some of the pol-
icy development tools support a workflow process within the
tool to facilitate approvals of the policies through the various
stages (such as draft, interim reviews, and final publishing),
there is no substitute for the oral collaboration on the policies.
Electronic communications are very flat and do not provide
expression of the meaning behind the words. Through the dis-
cussions within the various committees, the documented text
becomes clearer beyond just those with technical skills. The
purpose is more apt to be appropriately represented in the fi-
nal policies through the collaborative process.
Information Security Policy Process
Security policy development is a repetitive process, where ex-
isting policies are updated and new ones are created as
needed. The majority of the work is in creating the initial se-
curity policies, and hopefully, if these policies were written to
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 36/38
the appropriate level, modification of the policies should be
minimal. The majority of the work in policy development is
evaluating the policies against the introduction of new tech-
nologies, law and regulation changes, and changes to the busi-
ness. Most often, the existing polices will suffice and not re-
quire major change. This rate of small change can cause orga-
nizations to not pay the appropriate attention to the policy re-
view and update.
As a final note, it should be clear through the activities pre-
sented in this chapter that the information security officer is
the facilitator of the information security policy development,
but should not own them. The security policies should be
owned by the organization, which in most cases, is repre-
sented by the CEO and the executive management. There will
be much less challenging of the security policy if it is owned
and issued at this level, than if it is owned by the security offi-
cer, who may reside at a lower level within the organization
(except for large organizations where the CISO may be part of
the executive team).
All other security procedures, standards, guidelines, and im-
plementations are dependent upon the construction of a con-
sistent, easy-to-understand, coherent, and comprehensive in-
formation security policy. The time investment in this step is
very valuable and the impact to the organization should not
be underestimated. Following the steps in this chapter will
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 37/38
1.
2.
3.
4.
5.
6.
7.
lead to more efficient and effective information security pol-
icy development and subsequent acceptance.
Suggested Reading
Peltier, T. R. 2007. Information security policies and procedures: A
practitioner’s reference, 2nd ed. Boca Raton, FL: Auerbach.
Wood, C. C. 2009. Information security policies made easy, version 11.
Houston, TX: Information Shield.
Fitzgerald, T. 2004. Ten steps to effective Web-based security policy
development and distribution. EDPACS 31(9): 1–22.
Fitzgerald, T., Goins, B., and Herold, R. 2007. Information security and
risk management. In Official ISC ® Guide to the CISSP CBK, H.
A.Tipton and K. Henry, eds., 9–17. Boca Raton, FL: Auerbach.
National Institute of Standards and Technology (NIST). March 2009.
Special Publication 800–16 Revl (draft): Information security training
requirements: A role- and performance-based model (draft).
http://csrc.nist.gov/publications/drafts/800-16-revl/Draft-SP800-16-
Revl.pdf
National Institute of Standards and Technology (NIST). October 2003.
Special Publication 800-50: Building an information technology secu-
rity awareness and training program.
http://csrc.nist.gov/publications/nistpubs/800-50/NIST-SP800-
50.pdf
Gupta, U. 2010. Blog: Lessons learned from BP oil spill. Healthcare
Info Security (June 21).
2
3/27/23, 10:04 PM Chapter 6 Creating Effective Information Security Policies | Information Security Governance Simplified
https://learning.oreilly.com/library/view/information-security-governance/9781439811658/017-9781466551282-006.xhtml 38/38
http://blogs.healthcareinfosecurity.com/posts.php?postID=592