How to write an information security policy, plus templates

Examples of security policies

Security policies come in several forms, including the following:

• General information security policy. Provides a holistic view of the organization's need for security and defines activities used within the security environment.
• Access security policy. Addresses how users are granted access to applications, data, databases and other IT resources. This policy is particularly important for audits.
• Authentication policy. Governs how users are verified to access a system's resources.
• Password policy. Defines how passwords are configured and managed.
• Perimeter security policy. Defines how an organization protects its network perimeter from unauthorized access and the technologies used to minimize perimeter porosity.
• Cybersecurity policy. Defines how an organization prepares and responds to malware, phishing, viruses, ransomware and other attacks.
• Cloud security policy. Defines the security parameters for situations involving cloud-based technology, such as data storage and applications.
• Incident response policy. Addresses how an organization will respond to an out-of-normal situation that affects security.
• Patching policy. Defines the process for installing and managing patches for various systems, including security systems.
• Physical access policy. Addresses how company assets, such as data centers, office buildings, parking garages and other physical facilities, are protected from unauthorized access.

Why companies need security policies

IT policies and procedures complement each other. Policies highlight areas within security that need assistance, while procedures explain how that security area will be addressed.

Discrepancies and weaknesses in policies are often brought up during audits, so it's best to prepare in advance. It's also common for users to have safety concerns about their data and systems, so it's advised to disseminate security policies to employees and clients to alleviate their concerns.

How to prepare a security policy

Follow these steps when preparing a security policy:

1. Identify the business purpose for having a specific type of IT security policy.
2. Secure approval from senior management to develop the policy.
3. Adapt existing security policies to maintain policy structure and format, and incorporate relevant components to address information security.
4. Establish a project plan to develop and approve the policy.
5. Create a team to develop the policy.
6. Schedule management briefings during the writing cycle to ensure relevant issues are addressed.
7. Invite internal departments to review the policy, particularly the legal team and HR.
8. Invite the risk management team to review the policy.
9. Distribute the draft for final review before submitting to management.
10. Secure management approval and disseminate the policy to employees.
11. Establish a review and change process for the policy using change management procedures.
12. Schedule and prepare for annual audits of the policy.

Sample policy templates

This cybersecurity policy template and network perimeter security template identify the scope, purpose and requirements of an enterprise security policy. These templates can be modified to best fit your organization's needs.

Components of a security policy

Policies for information security and related issues don't need to be complicated; a few paragraphs are sufficient to describe relevant security goals and activities. More detail can be included as needed. The following outline can help your organization start the process:

• Introduction. States the fundamental reasons for having a security policy.
• Purpose and scope. Provides details on the security policy's purpose and scope.
• Statement of policy. States the security policy in clear terms.
• Statement of compliance. Specifies security laws, regulations, standards and other guidance with which the policy aims to comply.
• Policy leadership. States who is responsible for approving and implementing the policy, as well as levying penalties for noncompliance.
• Verification of policy compliance. States what is needed, such as assessments, exercises and penetration tests, to verify security activities are in compliance with policies.
• Penalties for noncompliance. States penalties for noncompliance, such as a verbal reprimand and a note in the noncompliant employee's personnel file for internal incidents and fines and/or legal action for external activities.
• Appendixes. Includes additional reference information, such as lists of contacts, service-level agreements and additional details on specific security policy statements.

The following list provides additional details on preparing a security policy. A policy should do the following:

• be developed by a team that can address operational, legal, competitive and other issues associated with information security;
• have input from internal departments on their security requirements;
• be discussed with HR to ensure uniform compliance by employees;
• be supported by senior management;
• specify who is eligible to access IT resources;
• specify security requirements for physical devices, such as laptops and firewalls;
• specify hardware and software security requirements;
• identify the frequency of change to security controls;
• be periodically tested, reviewed and updated to ensure relevance to the organization; and
• periodically be audited to ensure security controls are being followed.

Upon completion, the policy should be reviewed by IT management and the legal department. It's also important to circulate the policy to appropriate internal departments and external parties. Then, deploy the approved policy, and schedule ongoing review, audit and maintenance activities.