How to Write an Information Security Policy

This does not mean that the associated information protection goals should be removed from the Information Security Program. It just means that not all security strategy can be documented at the policy level of executive mandate. As the Information Security Program matures, the policy can be updated, but policy updates should not be necessary to gain incremental improvements in security. Additional consensus may be continuously improved using other types of Information Security Program documents.

Supplementary documents to consider are:

-- Descriptions of security responsibilities executed by departments other than the security group. For example, technology development departments may be tasked with testing for security vulnerabilities prior to deploying code and human resources departments may be tasked with keeping accurate lists of current employees and contractors.

-- Descriptions of technical configuration parameters and associated values that have been determined to ensure that management can control access to electronic information assets.

- Workflows demonstrating how security functions performed by different departments combine to ensure secure information-handling.