Policy Manuals

Our organizations with an information security management function already have security policies although they are often disjointed and incomplete. 

Worse they are usually being in captivity to security, covering primarily technical issues such as password criteria as well as antivirus controls. They typically sit on some dusty shelf as well as are only referred to in specific situation, such as when disciplinary action is planned against an employee who shares their password or disables the antivirus software. 

As security has evolved various people in various departments have written as well as published policies to suit their immediate requires. 

Is is common to find a variety of security related policies scattered around the organization, some on the intranet often in several different places at once, in various states of decay as well as others embedded in employment contracts, employee handbooks, union rulebooks, printed on the back of staff visitor passes as well as so on. 

The principles as well as it is widely accepted on its own merits are copied through from the body to an appendix which is short enough for senior management to review, discuss as well as approve separately from the rest of the manual. The appendix can also be used for general security awareness purposes.

We recognize with gratitude that a well-written, comprehensive as well as consistent information security policy manual is not an end in itself but it is certainly a great start for your Information Security Management System .