7.4 The security policy

A security policy is a short document containing a series of statements about all the organization's security aspects, set at a high level where it should not be changed very often. It should not be longer than a couple of pages in order to maintain the interest of the audience and improve readability. It should be easy to understand for people who have no knowledge of ICT. Below that you have a set of security baseline standards and procedures, that explain in more detail how the policy should be interpreted. It is a larger document that can change as time goes on, although not dramatically as it does not necessarily handle implementation details. A set of guidelines, to some extent technology based, will deal with implementation and so this document is adapted as technology changes.

There is an interaction between writing a policy and doing a risk assessment. The fact that a basic policy exists can demonstrate the concern of the top management for security issues. Once this concern has been expressed, further risk analysis can result in the policy being reviewed and other more detailed documents being composed.

The security policy contains general statements relating to:

• roles, authority and responsibility
• access controls and access control policies
• statutory and legal obligations concerning data protection, software copyright and company ownership of hardware, software and processed information; legal aspects of the use of cryptography
• contingency and business resumption planning
• security training and awareness
• auditing and internal control
• sanctions

Standards, guidelines and procedures cover issues of data ownership, classification of data and various standards and procedures: ``how must information be transferred'', ``how long should it be kept'', ``how should it be destroyed'', etc. Special issues in security are the control of outside access (only allow dial-up on special request, according to the procedures), the control of trusted ICT staff (use of non-erasable logs) and trusted non-ICT staff (split keys and distribute them over a number of persons).

Once the necessary documents have been drawn up and published, the next step is to make sure everybody throughout the company knows about the security policy. Letting the line managers sign self certifications saying that they implemented the policy implies an acknowledgement of responsibility. Security in this perspective is much like quality management: it is everybody's business.