Security Policies and Procedures
Security policies and procedures constitute the main part of any organization’s security.
These steps are essential for implementing IT security management: authorizing security
roles and responsibilities to various security personnel; setting rules for expected behavior
from users and security role players; setting rules for business continuity plans; and more.
The security policy should be generally agreed to by most personnel in the organization and
should have the support of the highest-level management. This helps in prioritization at the
overall organization level.
The following list, illustrated in Figure 3.3, is a sample of some of the issues an organization
is expected to address in its policies [7]. Note, however, that the universal list is virtually
endless, and each organization’s list will consist of issues based on several factors, including
its size and the value and sensitivity of the information it owns or deals with. Some important
issues included in most security policies are