Sharing the responsibility of developing policies

Developing corporate policies isn't the sole responsibility of the information security department.

As security professionals we often view the overall objective of an information security program is to protect

the integrity, confidentiality and availability of information. While this is true from a security perspective, it is not the organization's objective. Information is an asset and must be shared throughout the organization with those that have a business need for access. Furthermore, information is an asset of the entire enterprise and all employees are responsible for protecting it.

An information protection program should be part of any organization's overall asset protection program. The information protection program is a business function that provides management with the processes needed to perform their fiduciary duty. That is, management is charged with a trust to ensure that adequate controls are in place to protect the assets of the enterprise. An information security program that includes policies, standards and procedures ensures that management can demonstrate this standard of due care.

There are at least twelve organization-wide (Tier-1) policies and each should include reference to information security. As information security professionals, it is our responsibility to implement policies that reflect the business and mission needs of the enterprise. While it is not our sole responsibility to develop policies, it is our responsibility to work with the other business units to ensure that the enterprise-wide responsibility to protect information resources is included in all phases of the business process. In the chart below I've indicated the primary department responsible for developing each of the Tier-1 Policies, as well as the link to more information about each policy.

Tier-1 Corporate Policy Responsible Department
Employment Practices Human Resources
Employee Standards of Conduct Human Resources
Conflict of Interest Auditing
Performance Management Human Resources
Employee Discipline Human Resources
Information Security Information Security
Corporate Communications Corporate Communications – Public Relations
Procurement and Contracts Purchasing
Records Management Records Retention
Asset Classification Information Security
Work Place Security Physical Security
Business Continuity Planning Facilities Management

This was first published in June 2004

Dig deeper on Information Security Policies, Procedures and Guidelines

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close