Best Practices for Planning, Developing, and Managing Enterprise Security Policies

Executive Snapshot

• Figure: Executive Snapshot: Best Practices for Planning, Developing, and Managing Enterprise Security Policies

Situation Overview

• What Are Security Policies?

• Security Policies Versus Security Procedures

• Why Are Security Policies Important?

• Security Policy Challenges

• Ambiguous Requirements

• Technology Changes

• Diverse Stakeholders

• Lack of Policy Buy-In

• Policy Bloat and Sprawl

Advice for the Technology Buyer

• Base Policies on Compliance Mandates — But Be Flexible

• Use Policy Templates — But Only as a Starting Point

• Consult with Regulators and Auditors

• Consider Your Capabilities

• Assign Responsibility for Policy Creation

• Define a Policy Review Process

• Define a Plan for Policy Dissemination

• Establish Regular Policy Assessments and Gap Analysis

Learn More

• Related Research

• Synopsis