The organization should define information security related policies which is approved by management and sets the organization’s approach to managing its information security objectives.
a) Business Strategy, b) contracts, regulations and legislations and c) security threat environment are the source of requirements which “information security policies” should address.
What should “Information Security Policy” cover?
a) Definition of Information security, objectives and principles to direct all activities related to information security
b) Assignment of responsibilities of Information Security management to defined roles
c) Processes of handling non-conformities and exceptions
Indicative List of policies:
1) Information Security
2) Access control
3) Information classification and handling
4) Physical and environmental security
5) Acceptable use of assets
6) Clear Desk and clear screen
7) Information Transfer
8) Mobile device and teleworking
9) Restriction on software installations and use
11) Protection from malware
12) Management of technical vulnerabilities
13) Cryptographic controls
14) Communication security
15) Privacy and protection of personally identifiable information
16) Supplier relationships
These policies should be communicated to relevant internal and stakeholders in the context of awareness of information security.