What is an information security policy? – IT Governance UK Blog

It’s widely accepted that people are the weakest part of any organisation’s security defences. You can spend months designing flawless processes and you can invest in state-of-the-art technology to detect threats, but these both only work if the people using them know what they’re doing.

That’s why information security policies are arguably the most important part of an organisation’s defence. They are a list of instructions for staff to follow in various scenarios, covering a range of topics, such as acceptable passwords and how often to back up data.

What do information security policies do?

Information security policies are usually the result of risk assessments, in which vulnerabilities are identified and safeguards are chosen. Each policy will address a specific risk and define the steps that must be taken to mitigate it.

Where relevant, it will also explain how employees will be trained to become better equipped to deal with the risk.

For the threat of phishing, for example, the policy should explain what phishing is and instruct employees on who to contact if they suspect they’ve received a phishing scam. It will also detail whether the organisation covers phishing as part of its staff awareness training and when those courses take place. If the organisation has access to an e-learning staff awareness course, the policy should include a link to the relevant module.

Many information security policies are hierarchical: they will apply differently to various levels of seniority. More senior staff will generally have access to more sensitive information and use it in different ways, and the organisation’s policy must address that.

Need help creating your policies?

Documenting your policies takes a lot of time and effort, and you might still overlook key policies or fail to address important issues. However, you can avoid those problems with our bestselling Information Security Policy Template.

This customisable tool enables you to create an information security template that aligns with the best practices outlined in ISO 27001.

Whether you want to make sure you have complete coverage of your information security concerns or simply want to speed up the documentation process, this template is an ideal resource.

Find out more >>