Corporate Security Policy
Randy Bias wrote a helpful article called Architecting Practical Corporate Security Policies here. I especially liked the Example Policy Framework and the suggestions on what should be included in a Corporate Security Policy.
Here’s an excerpt:
Corporate Security Policy
Audience: Executive Management, particularly the CSO, CISO, and Senior INFOSEC StaffThis element is really the overarching framework within which the rest of your policies would be designed. It provides context for the entire policy framework, policy on creating policy, and pointers to which portions of the policy are relevant for which audiences.
Encompassed within the corporate security policy might be 5 key areas (in order):
- Risk Management Policy
- Core Policies
- Vendor & Service Provider Evaluation Policies
- Processes & Procedures
- Compliance Policy
Very useful info! Check it out!