Chapter 11 — Policy and obligations | Professional Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Policy and obligations

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 A usable policy"]
  N2["11.2 Obligations"]
  N3["11.3 Certification"]
  N4["11.4 Keeping it current"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 A usable policy"]
  N2["11.2 Obligations"]
  N3["11.3 Certification"]
  N4["11.4 Keeping it current"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 A usable policy]
    |
    v
[11.2 Obligations]
    |
    v
[11.3 Certification]
    |
    v
[11.4 Keeping it current]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) write a short, usable security policy; (2) map the firm's legal and professional obligations; (3) decide whether formal certification is worthwhile.

11.1 A usable policy

Corbridge's existing security policy is a twenty-page document copied from a template, which nobody has read. Daniel replaces it with a two-page policy covering the rules staff actually need: accounts and second factors, devices, handling client documents, email and payments, reporting and supplier use. Each rule has a one-sentence reason. Detailed procedures, such as the phone-back rule and the incident procedure, sit in separate documents linked from the policy. Mrs. Pike signs the policy, and each member of staff confirms they have read it during a team meeting.

11.2 Obligations

Daniel maps what the firm must do by law and by professional rules. Data protection law requires appropriate security for personal data and notification of certain breaches within set time limits. The professional body expects members to protect client confidentiality. Some larger clients require security commitments in their contracts. Daniel lists each obligation with its source and the controls that meet it. Ms. Ashby advises him to confirm legal points with the firm's data protection adviser rather than relying on his own reading, because obligations differ between countries and change over time.

11.3 Certification

A large client asks whether Corbridge is certified to ISO/IEC 27001:2022, the international standard for an information security management system. Daniel explains to the partners that certification requires a documented management system, internal audits and an external audit each year, which would take significant time for a firm of sixty. He suggests a middle path: align the firm's work with the standard's main ideas, such as risk assessment, leadership commitment and regular review, and reconsider certification if more clients ask. The partners agree, and Daniel writes a short response for the client.

11.4 Keeping it current

Daniel sets a simple calendar for reviewing the policy and related documents: the policy once a year, the risk register every three months, supplier answers yearly and the continuity plan before each busy season. Each review has a named owner. Ms. Ashby explains that a policy left untouched for years drifts away from how people actually work, and staff stop trusting it. She praises the short policy for being readable, and suggests that Daniel ask two staff members each year whether the rules make sense to them in practice.

Worked example

Daniel replaces a twenty-page template with a two-page signed policy, maps legal and professional obligations, and advises aligning with ISO/IEC 27001:2022 rather than certifying for now.

Synthetic case. The policy, client request and obligations are synthetic and general; real legal duties need professional advice.

Errors and limits

A long template policy that nobody reads gives a false sense of compliance.

Exercises

EX051 — Policy length. How long is Daniel's new policy? Rubric: 3 = two pages;; 2 = partly correct;; 1 = wrong;; 0 = none.
EX052 — Procedures. Where do detailed procedures go? Rubric: 3 = separate linked documents;; 2 = partly correct;; 1 = other;; 0 = none.
EX053 — Certification cost. What does certification require? Rubric: 3 = management system, internal and yearly external audits;; 2 = all;; 1 = some;; 0 = none.
EX054 — Middle path. What did Daniel recommend instead of certifying now? Rubric: 3 = align with the standard's main ideas;; 2 = partly correct;; 1 = vague;; 0 = none.
EX055 — Legal advice. Who should confirm legal points? Rubric: 3 = the data protection adviser;; 2 = partly correct;; 1 = other;; 0 = none.

Continue studying — lesson 11 (chapter 11 of 12)

← Chapter 10 · Course chapter index · Chapter 12 →

Continue to the next authored lesson.