Information Security Policies
Information security policies, whether corporate policies, business unit policies, or regional entity policies provide the requirements for the protection of information assets. An information security policy is often based on the guidance provided by a frame work standard, such as ISO 17799/27001 or the National Institutes of Standards and Technology's (NIST) Special Publication (SP) 800 series standards. The Standards are effective in providing requirements for the "what" of protection, the measures to be used, the "who " and "when" requirements tend to be organization-specific and are assembled and agreed based on the stakeholders' needs. Governance, the rules for governing an enterprise are addressed by security-relevant roles and responsibilities defined within the policy. Decision making is a key governance activity performed by individuals acting in roles based on delegated authority for making the decision and oversight to verify the decisi...