{"id":1682,"date":"2018-11-30T12:53:57","date_gmt":"2018-11-30T12:53:57","guid":{"rendered":"https:\/\/iso27001.solutions\/?p=1682"},"modified":"2019-03-11T17:57:46","modified_gmt":"2019-03-11T17:57:46","slug":"how-to-write-your-information-security-policy-according-to-iso-27001","status":"publish","type":"post","link":"https:\/\/ismsalliance.com\/trends\/about-iso-27001-standard\/how-to-write-your-information-security-policy-according-to-iso-27001\/","title":{"rendered":"How to write your Information Security Policy according to ISO 27001"},"content":{"rendered":"

Why consensus is key, what to cover and how make your information security policy \u2014 and program \u2014 effective?<\/h2>\n

An information security policy is the cornerstone of an information security program. It should reflect the organization’s objectives for security and the agreed upon management strategy for securing information.<\/p>\n

In order to be useful in providing authority to execute the remainder of the information security program, it must also be formally agreed upon by executive management. This means that, in order to compose an information security policy document, an organization has to have well-defined objectives for security and an agreed-upon management strategy for securing information. If there is debate over the content of the policy, then the debate will continue throughout subsequent attempts to enforce it, with the consequence that the information security program itself will be dysfunctional.<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/a><\/span><\/div><\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/div>
<\/div>
<\/div>

What to do first?<\/h2>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>

There is a plethora of security-policy-in-a-box products<\/a> on the market, but few of them will be formally agreed upon by executive management without being explained in detail by a security professional<\/a>. This is not likely to happen due to time constraints inherent in executive management.<\/p>\n

Even if it was possible to immediately have management endorse an off-the-shelf policy, it is not the right approach to attempt to teach management how to think about security. Rather, the first step in composing a security policy is to find out how management views security. As a security policy is, by definition, a set of management mandates with respect to information security, these mandates provide the marching orders for the security professional. If the security professional instead provides mandates to executive management to sign off on, management requirements are likely to be overlooked.<\/p>\n

If there is debate over the content of the policy, then the debate will continue throughout subsequent attempts to enforce it, with the consequence that the information security program itself will be dysfunctional.<\/p>\n

A security professional whose job it is to compose security policy must therefore assume the role of sponge and scribe for executive management. A sponge is a good listener who is able to easily absorb the content of each person’s conversation regardless of the group’s diversity with respect to communication skills and culture. A scribe documents that content faithfully without embellishment or annotation. A good sponge and scribe will be able to capture common themes from management interviews and prepare a positive statement about how the organization as a whole wants its information protected. The time and effort spent to gain executive consensus on policy will pay off in the authority it lends to the policy enforcement process.<\/p>\n

Good interview questions that solicit management’s opinions on information security are:<\/strong><\/p>\n