Manage Learn to apply best practices and optimize your operations.

Sharing the responsibility of developing policies

Developing corporate policies isn't the sole responsibility of the information security department.

As security professionals we often view the overall objective of an information security program is to protect the integrity, confidentiality and availability of information. While this is true from a security perspective, it is not the organization's objective. Information is an asset and must be shared throughout the organization with those that have a business need for access. Furthermore, information is an asset of the entire enterprise and all employees are responsible for protecting it.

An information protection program should be part of any organization's overall asset protection program. The information protection program is a business function that provides management with the processes needed to perform their fiduciary duty. That is, management is charged with a trust to ensure that adequate controls are in place to protect the assets of the enterprise. An information security program that includes policies, standards and procedures ensures that management can demonstrate this standard of due care.

There are at least twelve organization-wide (Tier-1) policies and each should include reference to information security. As information security professionals, it is our responsibility to implement policies that reflect the business and mission needs of the enterprise. While it is not our sole responsibility to develop policies, it is our responsibility to work with the other business units to ensure that the enterprise-wide responsibility to protect information resources is included in all phases of the business process. In the chart below I've indicated the primary department responsible for developing each of the Tier-1 Policies, as well as the link to more information about each policy.

Tier-1 Corporate Policy Responsible Department
Employment Practices Human Resources
Employee Standards of Conduct Human Resources
Conflict of Interest Auditing
Performance Management Human Resources
Employee Discipline Human Resources
Information Security Information Security
Corporate Communications Corporate Communications – Public Relations
Procurement and Contracts Purchasing
Records Management Records Retention
Asset Classification Information Security
Work Place Security Physical Security
Business Continuity Planning Facilities Management

This was last published in June 2004

Dig Deeper on Information security policies, procedures and guidelines

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.