INFOGRAPHICS
Starting a new IT security policy?
Consider these key policies and procedures
The absence of an IT security policy may highlight gaps in a company’s security and compliance posture. An effective policy serves as a risk-management plan addressing your company’s use of its technology solutions of choice. Your IT security policy will be made of multiple policies working together to maintain the confidentiality, integrity, and availability of your organization’s systems. An employee or committee may create your IT security policy, and it should be tuned to meet the unique needs of your company and its people. Your policy should be regularly reviewed and adapted to address evolving business and compliance requirements.
What is an IT security policy — and why does your business need one? An information technology (IT) security policy sets rules and procedures for the use of your company’s IT resources, with the goal of meeting user needs while protecting your company’s data and systems from unauthorized use. It is an essential part of your organization’s broader cybersecurity plan.
Describes guidelines, rules, and restrictions regarding use of organizational IT assets, to which employees must agree in order to utilize those assets
Outlines rules for network access, describes how policies will be enforced, and provides an overview of a company’s security environment
Establishes rules for access and use of a company’s network infrastructure
Outlines conditions that devices and users must adhere to in order to connect to a company’s wireless network
Describes data management procedures employees must follow when using mobile devices and software for network and data access
Outlines acceptable and unacceptable uses of a company’s electronic communication technology
Establishes rules for setting strong passwords and using them properly in order to enhance the security of computers and applications
Establishes rules for physical access to company premises
Defines approved methods of remotely connecting to internal organizational networks
Outlines rules and practices for use of virtual private network (VPN) connections
Describes how an organization and its employees may enter into agreements with external service providers to perform activities which would otherwise be performed internally
Defines company policy as to whether and how guests such as visitors and contractors may connect to an organization’s network
Establishes standards for company access to third-party networks, as well as for third-party access to and use of a company’s networks
Assesses all types of data under a company’s purview and classifies data according to sensitivity, value, and importance to the organization
Defines what information is considered confidential and how it should be managed
Establishes what devices and media must be encrypted, and when data encryption must be employed
Defines what, when, and how information from business applications is periodically saved, and backups are regularly tested, to ensure that data can be recovered in the event of an incident
Establishes protocols and time frames for information retention for operational or compliance purposes
Articulates how an organization will respond to an information security incident in order to limit its repercussions for customers and business operations
Describes a cross-organizational process for restoring or maintaining essential IT resources while operating in an emergency
Establishes a methodical process for making changes to IT, software, and security services
