Chapter 13 — Policies and standards

Chapter 13 — Policies and standards

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Document types"]
  N2["13.2 Writing a policy"]
  N3["13.3 International standards"]
  N4["13.4 Keeping policies alive"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Document types"]
  N2["13.2 Writing a policy"]
  N3["13.3 International standards"]
  N4["13.4 Keeping policies alive"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 Document types]
    |
    v
[13.2 Writing a policy]
    |
    v
[13.3 International standards]
    |
    v
[13.4 Keeping policies alive]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) distinguish policies, standards and procedures; (2) write a short security policy; (3) relate organisational policy to international standards.

13.1 Document types

Aisha learns to distinguish document types. A policy states what the organisation intends and requires, at a high level, such as all access to member data must be authorised. A standard sets specific mandatory requirements, such as passwords must be at least fourteen characters. A procedure describes step-by-step how to do something. Dr. Carrow explains that mixing these types produces documents that are too detailed to approve and too vague to follow, a common problem in small organisations. She sorts Ashfield's documents into the three types.

13.2 Writing a policy

Aisha drafts an access control policy for Ashfield. It states the purpose, scope, principles of least privilege and need to know, roles responsible and how compliance is checked. She keeps it to one page so staff will read it. Dr. Carrow reviews it and asks her to remove technical detail about password length, which belongs in a standard that can be updated without board approval. The final policy is short and clear. The board approves the policy at its next meeting without changes.

13.3 International standards

Aisha studies how organisations use ISO/IEC standards. ISO/IEC 27001:2022 sets requirements for an information security management system, including that top management establishes an information security policy. ISO/IEC 27002:2022 gives guidance on controls, including topic-specific policies such as access control. ISO/IEC 27000:2026 provides the overview of the family. She learns that Ashfield need not seek certification to benefit from using these standards as guidance. Aisha prepares a short table showing which Ashfield documents correspond to each of the main ISO/IEC 27002 control themes, and notes where Ashfield has nothing yet, such as supplier security.

13.4 Keeping policies alive

Policies go out of date. Aisha finds Ashfield's acceptable use policy refers to fax machines and makes no mention of cloud storage. She recommends an annual review with named owners and a change log. She also suggests a short quiz in annual training to check that staff understand key requirements. She learns that a policy nobody reads or updates provides little protection, regardless of how well it was written originally. The compliance officer takes ownership of the review schedule and adds each policy's review date to the board calendar.

Worked example

Aisha distinguishes policy, standard and procedure, writes a one-page access policy, relates it to ISO/IEC 27001 and 27002 and recommends annual review.

Synthetic case. Policies are synthetic; standards are paraphrased.

Errors and limits

Putting technical detail in policies forces board approval for routine changes.

Exercises

• EX037 — Standard example. Which is an example of a standard? Rubric: 3 = passwords at least fourteen characters;; 2 = partly correct;; 1 = other;; 0 = none.
• EX038 — Removed detail. What detail is removed from the policy? Rubric: 3 = password length;; 2 = partly correct;; 1 = other;; 0 = none.
• EX039 — Outdated policy. What did the acceptable use policy omit? Rubric: 3 = cloud storage;; 2 = partly correct;; 1 = other;; 0 = none.

Continue studying — lesson 13 (chapter 13 of 40)

← Chapter 12 · Course chapter index · Chapter 14 →

Continue to the next authored lesson.