Security policies are living, breathing documents that can profoundly impact the way a company operates. Constructed...
well, they provide the absolute minimal amount of constraint that achieves the goals of the security organization while still allowing the company to remain agile.
Constructed poorly and without context of the company and its culture, policies for their own sake will ultimately yield a set of unenforceable and inexplicable rules that nobody follows because they simply get in the way.
So the first thing that should be done to help clients create and implement end-user security policies is to understand how security is perceived, instantiated and operationalized within the company. An overall assessment of the company's security strategy should be done to determine the best approach toward creating a framework of policies, procedures and guidelines.
Depending upon the company's tolerance for risk, their culture and regulatory/business requirements, an appropriate set of end-user security policies can be crafted. Aligning them to a security strategy framework means that the policies can be effectively managed across their lifecycle.
It is also very important to set the expectation that policies need to be reviewed and amended at least annually and that these policies should be a business-driven and owned activity, not just a security concern. Encouraging business owners from across the company to participate in the creation and review of these policies is essential if one expects them to be enforced effectively.
Of course, if a customer just wants a set of end-user security policies they can customize and are not interested in a business-aligned security program, there are numerous sets available for purchase or freely downloadable via the Internet.
Related Q&A from Christofer Hoff
Learn why companies that place too much emphasis on security regulatory compliance run the risk of neglecting a full-orbed structured assessment ...continue reading
Data leakage prevention (DLP) has become a feature of much larger information-centric lifecycle management suites of large companies with expansive ...continue reading
Learn why the upcoming changes to the Payment Card Industry Data Security Standard (PCI-DSS), designed to prevent further corporate data breaches, ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.