After years in IT Service Management (ITSM), now I know that the first Information Security Policy that came into my hands was \u2013 a miss. It was more like a small book. That document (I wouldn\u2019t even call it a \u201cpolicy\u201d) contained all that was relevant for information security management. Did I read it? No, at least, not much of it. After many years dealing with policies, processes, and ITSM in general, I know that documents need to be fit for purpose. Policies are not lengthy documents.<\/p>\n
In the case of an Information Security Policy, such document needs to give a general approach and direction for information security management. Let\u2019s see how ITIL<\/a> and ISO 20000<\/a> tackle this topic so you can use the requirements (section 6.6, in the case of ISO 20000 implementation) and\/or recommendations (in the case of ITIL implementation) to build a strong foundation for information security management.<\/p>\n The Information Security Policy<\/a> can be seen as the driver of all information security activities. Based on the requirements set in the policy, the company will implement and maintain information security controls in order to preserve the confidentiality, integrity, and availability of information assets of the company (see the article If anything shouldn\u2019t be taken for granted\u2026 it\u2019s Information Security Management<\/a>\u00a0to learn more).<\/p>\n The Information Security Policy is high-level (meaning, no details) or top-level policy. That means that this policy will provide general guidelines and direction for how to approach information security inside the organization, or in the SMS (if you are implementing ISO 20000).<\/p>\n That fact opens the following consideration \u2013 information security has to cover a broad scope and a large number of topics (e.g., access to the system\/premise, communication security, security of people, etc.), and the Information Security Policy doesn\u2019t go deep into details. How do you regulate all the needed areas of information security? Well, this is why the Information Security Policy is called a \u201ctop-level\u201d policy \u2013 based on it, the organization will create other, more detailed policies (e.g., Access control policy<\/a>, Information classification policy<\/a>, Password policy<\/a>, etc.).What is the purpose?<\/h2>\n
\n