◇ OpenCyber Academy
Technologist · Chapter 24 · English

Chapter 24 — Policies and procedures

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 24 — Policies and procedures

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Policies and procedures"]
  N2["24.2 Writing procedures"]
  N3["24.3 Version control"]
  N4["24.4 Linking to policy"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Policies and procedures"]
  N2["24.2 Writing procedures"]
  N3["24.3 Version control"]
  N4["24.4 Linking to policy"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Policies and procedures]
    |
    v
[24.2 Writing procedures]
    |
    v
[24.3 Version control]
    |
    v
[24.4 Linking to policy]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) distinguish policies from procedures; (2) write clear procedures for technical tasks; (3) keep documents current.

24.1 Policies and procedures

Jamal learns that a policy states what must happen, such as all staff accounts must use multi-factor authentication, while a procedure explains how to do it step by step. Riverbend's policies are written by the IT manager and approved by the chief executive. ISO/IEC 27002:2022 provides guidance on policies for information security, which Riverbend uses as a reference. Ms. Grant notes that technologists mostly write and follow procedures, so clear procedures are part of their craft. He reads the current policies before writing anything.

24.2 Writing procedures

Jamal writes procedures for tasks he performs: creating accounts from templates, running the monthly workstation check and handling a lost phone. Each lists purpose, when to use it, steps, expected results and what to do if something goes wrong. He tests each procedure by asking the technician to follow it without help. Two steps are unclear and he rewrites them. He learns that a procedure is good only if someone else can follow it. The technician says the revised versions are clear enough to use alone.

24.3 Version control

Jamal stores procedures in a shared folder with version numbers, dates and owners. Old versions are archived, not deleted, so the team can see what changed. He adds a review date to each. Ms. Grant explains that procedures referring to old screens or settings cause mistakes, so regular review is necessary. He sets reminders for six-monthly reviews. He also adds a short change note at the top of each document explaining what changed in the latest version and why, so readers do not have to compare versions themselves. The IT manager approves the structure and asks that all IT documents follow it.

24.4 Linking to policy

Each procedure refers to the policy it supports, so readers understand why the task matters. Jamal notices that the password policy still mentions monthly changes, though practice has changed. He asks the IT manager to update the policy so practice and policy agree. Ms. Grant notes that auditors check whether practice matches policy, and that outdated policies create avoidable findings. The IT manager updates the policy the following month and the chief executive approves the change. Jamal checks the other policies against current practice and finds no further contradictions.

Worked example

Jamal distinguishes policy from procedure, writes and tests three procedures, adds versions and review dates and gets an outdated password policy updated.

Synthetic case. Documents are synthetic.

Errors and limits

Policies that contradict practice create avoidable audit findings.

Exercises

Continue studying — lesson 24 (chapter 24 of 30)

← Chapter 23 · Course chapter index · Chapter 25 →

Continue to the next authored lesson.