Security Policy Review

Full Analysis of Your Policies

Policies are a fundamental aspect of information security; they provide the management direction for security co-ordination and the basis for all security initiatives.

A common approach, especially amongst SMEs, is to adopt the Staff handbook as ‘company policy’ which is an ineffective approach.

Ideally, policy should reflect business requirements, be easily understandable to the desired audience, should be succinct and enforceable. Policy structure can be tiered to support the size of the business and business needs.

Realistically, policy should be aligned with business objectives and security should be embedded in business as usual (BAU) as opposed to being a sticky plaster reactive approach.

Many clients will produce long and detailed policies that are too impractical for successful enforcement. Quite often, the policies are neither read nor understood, have been produced to satisfy auditors as a tick-box exercise.

This service (following policy review) can also help to fill policy gaps and ISMS Matters can provide/author baseline policies and standards that are then modified by the particular client to suit their business environment.

This approach reduces the client cost as internal resource can be utilised for the modification activity.

Ideally, the best approach (from our experience), is for us to actually produce policy and standards documentation that accurately reflects current business requirements, however, this will probably require increased consultancy to identify and map to business operations.

This service has in the past also covered the authoring of configuration standards. It is very important that skill set requirements are identified (depended on the technologies that need to be documented) for adequate resourcing.

If research time is required (and agreed by the client), this needs to be built into the proposed consultancy time. Authorship of configuration standards can also easily fall into the Information Assurance, PCI DSS or Security Assurance practice areas.