Your Information Security Policy needs to be robust and protect your organization from internal and external threats. Its scope should be exhaustive, yet it should make room for updates and edits and keep pace with the changing business environments and threats. It sets the tone and foundation for how you plan to protect your organization’s information assets. In short, it’s serious business!

So, how should you go about drafting your Information Security Policy? For starters, don’t blindly pick a template off the internet. It requires serious contemplation and coordination with key organizational stakeholders to script your Policy. Read on to understand the nuances of your Information Security Policy – what it is, why it is important, and how you should build one for your organization.

What Is an Information Security Policy?

ISO 27001 Information Security Policy is a mandatory high-level document that provides management direction and support for implementing information security in the organization. Typically, it’s a compilation of many individual policies crafted to protect the confidentiality, integrity and availability of an organization’s information assets. The Information Security Policy, therefore, must be tailored to meet your organization’s business requirements and comply with the relevant laws of the land. 

Notably, the ISO 27001 requirements are that the Information Security policy needs to have management buy-in. It also mandates that the Policy be shared with all staff (via the company intranet and other venues per the organization’s choice). You can also share the Policy with customers and prospects to demonstrate the organization’s commitment to information security.

So, in essence, the Information Security Policy lays the foundation to educate and empower your staff to become more security-aware and serve as guideposts on the todos in case of a data breach or cyber attack. 

Annex 5 of ISO 27001 standard sets the tone for the Information Security Policy by highlighting its objectives and must-haves. 

What policies should you include?

ISO 27001 isn’t prescriptive. So, you will need to add topic-specific policies per your organization’s data security requirements. Even so, here are some pointers to keep in mind while drafting your policies:

• Coverage
  Your policies must cover all the critical information assets of your organization, such as software, hardware, and people.

• Basis
  If we further drill down, your policies should consider your business strategy, regulations, contractual obligations, and the prevalent and projected information security risks.

While the Information Security Policy is a high-level document, it needs to be rooted in the specificities centered around your organization’s security needs that will be identified and defined in the pack of policies that make it up.

Here are some examples of the policies that you can include:

Acceptable Use Policy

The policy outlines the acceptable as well as non-acceptable use of your organization’s systems, such as company-issued electronics, computing, storage, or network device. The scope also covers systems on the internet, and intranet, such as your servers, software, operating systems, storage, and network accounts.

As cloud-hosted organizations, you must also include in your policy scope third-party providers of services such as email, storage, infrastructure, software, data, APIs, and business systems that are accessed via devices owned or leased by you, your staff, and any third party. For instance, access to company emails, Github, and AWS, to name a few. 

The policy must also define what’s non-acceptable for your staff such as unauthorized copying, distribution, or use of copyrighted material, sharing credentials for any of your organization’s systems with others, and forwarding confidential business emails or documents to personal external email addresses, among others.

Any inappropriate use of your organization’s assets can have legal, regulatory, contractual and business implications. Therefore, it’s a good practice to define and set clear boundaries on what’s acceptable and unacceptable and the ramifications of noncompliance.

Access Control

This policy applies to specific (critical) systems in your organization that, from an access standpoint, have significant business ramifications, such as your ability to meet service commitments and store customer data. It outlines the usage privileges of your staff.

For instance, you should give your engineering team access to your production infrastructure. You needn’t give it to the marketing team. Another example of where you must enforce access control is in access to your systems that store, version and track changes to the source code of your software.   

The policy should also outline the consequences of unauthorized access. 

Data Backup

This policy describes how often your operational and customer data are backed up on your organization’s systems. It can mention the rules and procedures that apply, including how long the data should be aged before it must be backed up again. 

In practice, organizations can back up critical data files, databases, programs, softwares, and hardware elements such as servers and specific computing devices. 

Data Classification

This policy establishes a framework to classify your stored data based on its sensitivity, value and criticality to the organization. Organizations must based on the classification and access level, map the data to relevant access control to protect it. This secures sensitive corporate data and customer data appropriately and lowers the risks associated with their mishandling. 

Encryption

This policy helps secure the data you don’t want others to have access to by enforcing encryption. Encryption encodes data such that it is hidden or inaccessible to unauthorized users. The policy document should outline the scope to define whom it applies to within your business ecosystem and data encryption at rest and in transit.

For a cloud-hosted software organization, the policy must apply to the production environment, including endpoints and cloud assets used in hosting customer services, and any end-user devices that store such data. You can also bring any third-party systems that support your business into the policy’s ambit. 

Endpoint Security

An organization’s endpoints cover a wide array of devices used for business such as laptops, desktops, corporate- and employee-owned smartphones, and IoT sensors, to name a few. This policy helps define the endpoints and holds greater relevance today when businesses are adopting a hybrid/remote work model. Endpoint security protects your systems when your business enables remote access. 

The policy must be drafted based on the classification of data protection needs of endpoints.

Your policy can list the critical firmware, and software updates that specific endpoints should implement.

For instance, your policy could enforce the installation of antivirus software on endpoints with access to production systems.

Though not an exhaustive list, here are some of the other policies that can comprise your information security policy framework:

• Physical & Environmental Security
• Information Transfer
• Network Security
• Information Security Incident Response Plan or Management
• Cryptography & Key Management
• Management of Technical Vulnerabilities
• Disaster Recovery
• Password Policy
• Risk Management Policy
• Vendor Management Policy
• Change Management Policy
• Media Disposal Policy
• Vulnerability Management Policy
• Clean Desk Policy
• Business Continuity Management

Why is an Information Security Policy important?

Information Security Policy is important because it sets the tone and foundation to protect your organization’s information assets from internal and external threats. Here’s a quick overview of why you should take a serious effort in drafting your organization’s policies:

Acts as a Guideline for Secure Information Sharing

It lays the guidelines for the Dos and Donts for information sharing via sub-topic policies such as Data Classification, and Access Control, to name a few.

Defines and Communicate Roles and Responsibilities

The Policy clearly defines the staff’s role in data protection and assigns ownership of implementation to specific resources.

Protects Organization from Legal Liabilities

Setting the policy framework helps organizations protect themselves from legal liabilities due to inappropriate use of information.

Outlines Incident Management & Business Continuity Plans

The policy offers guidance and defines the todos in case of an information security incident such as a data breach or cybersecurity attack to reduce loss of business and ensure business continuity.

Framework-agnostic

Not just for ISO 27001, you can use the information security policy for other compliance standards such as SOC 2, HIPAA, and FEDRAMP.

How to Implement Information Security Policy Templates?

You can draft the best policies and have the best ISO 27001 security controls in place. But that’s all it can ever be – paper perfect; unless it’s internalized and put to action by everyone in your organization. So, how can you implement your Information Security Policy, you ask? By way of security awareness training for your staff. A well-trained workforce is a key to the success of any Information Security Management System (ISMS).

Requirement 7.2.2 of ISO 27001 states: “All employees of the organization and, where relevant, contractors and third-party users should receive appropriate awareness training and regular updates in organizational policies and procedures, as relevant for their job function.”

How can I create an Information Security Policy Template?

While you can create an Information Security Policy in minutes with the many free downloadable security policy templates available on the internet, it wouldn’t really ‘snug fit’ your organization’s security needs.

You can, however, use them as a starting point and customize them to your needs. While you do that, remember that your Policy should be derived from the following:

• Your Business Strategy & Requirements
• Regulations, Legislation & Contracts that impact your business
• Your Current & Projected Information Security Risks & Threats

As per ISO 27002, your Information Security Policy must contain statements concerning:

• Definition of information security
• Information security objectives or the framework for setting information security objectives
• Principles to guide all activities relating to information security
• Commitment to satisfy applicable requirements related to information security
• Commitment to continually improve the information security management system
• Assignment of responsibilities for information security

The responsibility for developing, reviewing, and approving topic-specific policies can rest with function heads with the appropriate competencies. Remember, all policies should be reviewed and assessed periodically to improve your organization’s data security. Reviews can include inputs from audits (internal audit and certification audit), security incidents, and management reviews.

Your organization’s information security policies must have buy-in from top management at every step.

Build Your Own Information Security Policy Document the Easy Way

We understand that it’s much work to build your Information Security from scratch or borrow the free online templates and build on them confidently.

At Sprinto, we have solved this problem for you by making 20+ editable versions of the oft-used policies in plain-speak English (minus the legal jargon). Hundreds of our customers have embraced our bank of editable policies that security experts authored.

What’s more, our in-house compliance experts work with you every step of the way to ensure your risks are covered so you can confidently move forward.

Sprinto’s intuitive mix of compliance automation with human intervention can take away a lot of similar pain points in your compliance journey. Talk to us today to find out how you can breeze your way through an ISO 27001 certification.