BUILDING AN EFFECTIVE INFORMATION SECURITY POLICY ARCHITECTURE
CONTENTS 1 INTRODUCTION HISTORY OF POLICY DOCUMENTS WHY DO WE REALLY NEED POLICIES? WHAT FOLLOWS 2 THE ENTERPRISE POLICY ARCHITECTURE DESIGN PROCESS SETTING THE REPORTING STRUCTURE DETERMINING THE MISSION STRATEGIC PLANS SUMMARY 3 WHAT IS A POLICY ARCHITECTURE? BASIC DOCUMENT DEFINITIONS EFFECTIVE POLICY ARCHITECTURE SCOPE OF THE ARCHITECTURE TOP-LEVEL TOPICS 4 GETTING READY TO START REVIEWING WHAT IS IN PLACE BASIC ASSESSMENT POLICY WRITING SKILLS A FRAMEWORK OR SET OF STANDARDS? MANUALS OF STYLE DO I NEED TO CREATE A COMMITTEE? INITIAL APPROVALS FOR INFORMATION SECURITY 5 WRITING THE DOCUMENTS POLICY GUIDELINE STANDARD GENERAL STANDARD TECHNICAL STANDARD WORK INSTRUCTION USER WORK INSTRUCTION IT WORK INSTRUCTION MEMOS FORMS CAUTIONS 6 ADDITIONAL KEY POLICY TOPICS MISCELLANEOUS ITEMS PHYSICAL SECURITY PERSONNEL SECURITY BADGING STAFF AUTHORIZED NON-EMPLOYEES VISITORS PRIVACY THIRD PARTIES APPLICATION REQUIREMENTS 7 PUTTING IT TOGETHER TOPICS TO START WITH REVIEWS PROJECT APPROVAL DOCUMENT APPROVAL SUPPORT PUBLISHING UPDATES—EFFECTIVE VERSIONING ACKNOWLEDGMENT OF UNDERSTANDING EXCEPTIONS TO THE INFORMATION SECURITY POLICY ARCHITECTURE DOCUMENTATION 8 CRAFTING COMMUNICATION FOR MAXIMUM EFFECTIVENESS BARRIERS TO EFFECTIVE COMMUNICATION LISTENING KNOW YOUR AUDIENCE WHAT IS THE ENTERPRISE STANDARD METHOD OF COMMUNICATION? LUNCH AND LEARNS WRITTEN EMPLOYEE HANDBOOK INTRANET INFORMAL TRAINING DEATH BY POWERPOINT NO SUCH THING AS A STUPID QUESTION ATTENTION SPANS CONSTRUCTIVE FEEDBACK (AKA DO NOT TAKE IT PERSONALLY) 9 SECURITY MONITORING AND METRICS MONITORING FOR ENFORCEMENT BASELINES ROUTINE METRICS REPORTING 10 CONTINUING TO MOLD YOUR STYLE THROUGH EXPERIENCE