It Security Policy: Key Components & Best Practices for Every Business

Back in 2017, The Economist declared that the world’s most valuable resource is data. And a cursory look at the 2020 Forbes most valuable brands most valuable brands reveals that indeed tech runs the world now.

The downside of this is significant. There’s now great pressure on companies to secure the information in their custody. Recent hacks involving SolarWinds, Twitter, and Garmin indicate that threats to information security continue to evolve, and all organizations have no option but to put in the legwork to establish and maintain required cybersecurity controls, whether their IT is on-premise, on cloud or outsourced.

From a governance perspective, an IT Security Policy is at the heart of this effort.

(This article is part of our Security & Compliance Guide. Use the right-hand menu to navigate.)

Why do we need an IT security policy?

According to the ISO 27001:2013 standard, the objective of information security (InfoSec) policies is to provide management direction and support for information security in accordance with business requirements and relevant laws and regulations.

An IT security policy is a type of administrative control that communicates to all stakeholders involved in IT so that they understand what is expected of them in reducing the risks associated with information security. (It is not limited only to the security team.)

It also demonstrates the commitment by the highest level of leadership within the organization to the ideals of the policy, therefore providing direction for the rest of the employees, suppliers, and other stakeholders.

(Explore the roles of Chief Information Security Officer and the security team.)

Whether at a strategic or tactical level, the IT security policy states ‘why’ the organization has taken a position to secure its IT systems. Most times, the rationale comes from:

• The value that the information held brings to the organization
• The need for trust from customers and stakeholders
• The obligation to comply with applicable laws

This is crucial from a governance perspective as it sets the tone for the design and implementation of IT security controls, and also institutes the relevant roles and responsibilities required for IT security to be managed effectively.

What’s in an IT security policy?

At the core of any IT security policy is understanding and managing the risks to IT systems and data.

How the organization does this is by defining their chosen approach to achieving the required security posture or characteristics through relevant administrative, physical, and technical controls.

The ITIL® 4 Information Security Management practice spells out some of these security characteristics as follows:

• Confidentiality: The prevention of information being disclosed or made available to unauthorized entities.
• Availability: A characteristic of information that ensures it is able to be used when needed.
• Integrity: An assurance that information is accurate and can only be modified by authorized personnel and activities.
• Authentication: Verification that a characteristic or attribute which appears or is claimed to be true is in fact true.
• Non-repudiation: Providing undeniable proof that an alleged event happened, or an alleged action was performed, and that this event or action was performed by a particular entity.

(Learn more about the CIA triad and additional security characteristics.)

The structure and size of an IT security policy varies from one organization to another, depending on their context:

• Some organizations deploy a large document with a lot of information on the controls.
• Others go for the simpler one-pager that references and points to other supporting documentation.

In terms of content, we can borrow from the CMMC model on what to include in your security policy:

• Purpose and scope
• Roles and responsibilities
• Establishment of procedures to meet the policy’s intent
• Regulatory guidelines addressed
• Endorsement by management and dissemination to appropriate stakeholders
• Framework for periodic review and updating
• Reference to applicable sub-policies, procedures and controls