Chapter 4: Information Security Policy
Issue-specific Security Policy (ISSP)
An organizational policy that provides detailed, targeted guidance to instruct all members of the organization in the use of a resource, such as one of its processes or technologies.
Guidelines
Non-mandatory recommendations the employee may use as a reference in complying with a policy. If the policy states to "use strong passwords, frequently changed," the guidelines might advise that "we recommend you don't use family or pet names, or parts of your Social Security number, employee number, or phone number in your password
Procedures
Step-by-step instructions designed to assist employees in following policies, standards, and guidelines. if the policy states to "use strong passwords, frequently changed," the procedure might advise that "in order to change your password, first click on the windows start button, then..."
Information Security Policies
Written instructions provided by management that inform employees and others in the workplace about proper behavior regarding the use of information and information assets.
Standard
a detailed statement of what must be done to comply with policy, sometimes viewed as the rules governing policy compliance. if the policy states that employees must "use strong passwords, frequently changed," the standard might specify that the password "must be at least 8 characters, with at least one number, one letter, and one special character"
Practices
Examples of actions that illustrate compliance with policies. If the policy states to "use strong passwords, frequently changed," the practices might advise that "according to X, most organizations require employees to change passwords at least semiannually"
Policy
In business, a statement of managerial intent designed to guide and regulate employee behavior in the organization; in IT, a computer configuration specification used to standardize system and user behavior
System-Specific Security Policies (SysSPs)
Organizational policies that often function as standards or procedures to be used when configuring or maintaining systems. SysSPs can be separated into two general groups, managerial guidance and technical specifications, but may be written as a single unified SysSP document
Access Control Lists (ACLs)
Specifications of authorization that govern the rights and privileges of users to a particular information asset. Includes user access lists, matrices, and capability tables.
Enterprise Information Security Policy (EISP)
The high-level information security policy that sets the strategic direction, scope, and tone for all of an organizations security efforts. An EISP is also known as a security program policy, general security policy, IT security policy, high-level InfoSec policy, or simply an InfoSec policy