Pass your certification exam. Faster. Guaranteed.

Information Security Policy Transcription

Welcome to our Information Security Policy module. In this module we will discuss policies, procedures, standards, baselines, and guidelines. When we're developing our policies and procedures, we should start off by looking at laws and regulations that we are required to follow in our industry, and also take a look at best practices.

These will be our drivers in developing our policies. We will then develop our organizational policy, which is our management's statement on security. Once we have this policy in place, we can then begin working on our functional policies, which will focus on the issues affecting our business and our specific systems.

And these are the security directives that are provided by our management staff. From these policies, we will be able to develop standards, procedures, baselines, and guidelines. The National Institute of Standards and Technology, or NIST, provided a special publication, 800-12, to help with information technology security. It describes the need for computer security based on laws and regulations, the desire to avoid liabilities, and also to provide best practices for computer security.

It establishes the management's responsibilities, which is to create a computer security program, and then assign roles and responsibilities as necessary. It discusses the components of your policies, like compliance issues, the overall goal of your computer security policy, and the scope. And also provides information on organizational policies, such as your internet policy, privacy policy, and acceptable use policy.

When you attempt to provide information security in your organization, you will not be successful unless you have security policies that are easy to understand and are implemented throughout the entire organization. (ISC)2 certifications are very focused on preparing written plans, procedures, and policies. You must first start off with a broad statement from your upper management about your overall security goals.

In your enterprise, you should have everything that you expect spelled out in writing with clear responsibilities for your employees. You should have step-by-step procedures, which are very detailed, and make it clear what should be done and how to accomplish it. In order to ensure compliance, you should always have someone accountable for enforcing these policies.

There are several different types of policies. Regulatory policies are designed to make sure that your organization is complying with the industry regulations. These policies are often used in government regulated entities, and are often very detailed. Advisory policies will advise against unacceptable behavior, and it will provide regulations that are prohibited. It also provides punishments for non-compliance with the policy. Informative policies are not generally enforceable, but they provide some information about different issues that are relevant to your organization. Standards are binding or mandatory. These rules are not optional, and they dictate how hardware and software should be used, and the expected behavior of your employees.

Baselines are considered to be mandatory and binding, and this explains a minimal level of security that will be required on all of the devices in your organization. Procedures are also considered to be mandatory, and they provide detailed, step by step actions that a user should take to perform some type of task.

Guidelines are not considered binding or mandatory. They are typically used as operational guides, and provide your employees with some recommended actions. You should remember, for the CISSP exam, that standards, baselines, and procedures are all mandatory, and guidelines is the only one that is not. Guidelines are meant to be simply a guide for employees to follow.

This concludes our Information Security Policy module. Thank you for watching.