Illustration and Examples of Policies, Standards, Guidelines, and Procedures (Reserve for Brilliant Answers Only)

Information Security Policy, Standards, and Practices 179

Policies function like laws in an organization because they dictate acceptable and unaccept- able behavior there, as well as the penalties for failure to comply. Like laws, policies define what is right and wrong, the penalties for violating policy, and the appeal process. Standards, on the other hand, are more detailed statements of what must be done to comply with policy. They have the same requirements for compliance as policies. Standards may be informal or part of an organizational culture, as in de facto standards. Or, standards may be published, scrutinized, and ratified by a group, as in formal or de jure standards. Practices, procedures, and guidelines effectively explain how to comply with policy. Figure 4-2 shows the relation- ships among policies, standards, guidelines, procedures, and practices. This relationship is further examined in the nearby Offline feature.

The meaning of the term security policy depends on the context in which it is used. Govern- mental agencies view security policy in terms of national security and national policies to deal with foreign states. A security policy can also communicate a credit card agency's method for processing credit card numbers. In general, a security policy is a set of rules that protects an organization's assets. An information security policy provides rules for protection of the organization's information assets.

Management must define three types of security policy, according to Special Publication (SP) 800-14 of the National Institute of Standards and Technology (NIST):

1. Enterprise information security policies

2. Issue-specific security policies

3. Systems-specific security policies

Practices

Industry, government,

and regulation

exemplars ----------- Guidelines

Influence organization

Recommendations for compliance

documents - ..... ---..-----.-Procedures Step-by·step instfUctioos for Of!lpllance

Figure 4-2 Policies, standards, guidelines, and procedures

Copyright 2018 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. WCN 02·300