Security Policy Development and Lifecycle

What policies are for

Policies are management’s instructions to the organisation: what must be protected, who is responsible, and what’s expected of everyone. They give the security program its authority. Everything else (standards, procedures, guidelines) supports them. One CISM task is to establish and maintain information security policies to guide the development of standards, procedures and guidelines.

The documentation hierarchy

Document	Purpose	Mandatory?	Example
Policy	Management intent and direction	Yes	“Access is granted on a need-to-know basis.”
Standard	Specific, measurable requirements	Yes	“Passwords at least 14 characters; MFA for remote access.”
Procedure	Step-by-step instructions	Yes	“How to grant access in the HR system.”
Guideline	Recommended practice	No	“Consider using a passphrase.”

Lower-level documents must support the higher ones, with no contradictions.

The policy life cycle

1. Identify the need: risks, laws, strategy, incidents, audit findings.
2. Draft: short, clear, technology-neutral, with an owner.
3. Consult: the business, legal, HR and IT, to make sure it’s workable.
4. Approve: senior management; the top-level policy often by the board.
5. Communicate: publish, train and get acknowledgement.
6. Enforce and monitor: controls, compliance checks, exceptions.
7. Review: at least yearly, and whenever the business, laws, technology or threats change significantly.

What makes a good policy

• Aligned with business objectives and the strategy.
• Clear and short, readable by everyone, stating intent rather than detail.
• Technology-neutral, so it survives technology change; specifics go in standards.
• Enforceable: realistic, with consequences and an exception process.
• Owned, with a version, effective date and review date.
• Approved by senior management, visibly.

A common policy set

Policy	Covers
Information security policy	Overall intent, scope, roles, principles
Acceptable use	Rules for systems, email, internet and devices
Access control	Granting, reviewing and removing access
Data classification and handling	Levels and handling rules
Incident response	Reporting and handling incidents
Third-party security	Supplier requirements and oversight

Other common topics include remote working, mobile devices, cryptography, backup, change management and AI use.

How the exam asks about it

If the question asks…	The answer is usually…
Who approves the information security policy?	Senior management (or the board)
Most important attribute of a policy	Alignment with business objectives and management intent
Where do product-specific settings belong?	In standards, not policy
When should policies be reviewed?	At least annually, and on significant change
First step in developing a policy	Understand the business needs, risks and requirements

In short

• Policies state management's intent and direction; standards, procedures and guidelines support them.
• The information security policy is approved by senior management (the top-level policy often by the board) and signed or endorsed visibly.
• Good policies are short, clear, technology-neutral, aligned with business objectives and enforceable.
• The life cycle: identify need, draft, consult, approve, communicate, enforce and monitor, review.
• Policies are reviewed at least annually and when the business, laws, technology or threats change significantly.
• Every policy has an owner, a version, an effective date and a review date.

Exam traps

• Policies don't name products or settings; standards do.
• A policy written by security without consulting the business is often unworkable and ignored.
• Approval by the CISO alone lacks authority; senior management approves.
• A policy that isn't communicated or enforced is ineffective.

Slides

Click the slide and use the arrow keys. F toggles full screen.