Stop 11 · GRC: Governance, Risk & ComplianceTopics · 4/9

Security Policies & Procedures

In short

If security rules live only in one person's head, they vanish when that person goes on leave. Written policies and procedures make good habits repeatable for everyone.

Writing the documented rules and step-by-step processes that operationalize a security program — a policy states the 'what' and 'why', a procedure details the specific 'how'.

The blob as a hostel warden holds a thick rule book and a checklist card.

Think of it like this

Hostel rules and the warden's routine

The hostel rulebook says "gates close at 10 pm, for student safety". The warden's routine says how: lock gate 1, check the register, call late students' parents. One is the what and why, the other is the exact steps. Policies and procedures split the same way.

Watch it happen

From big rule to daily step

Policy

Standard

Guideline

Procedure

Reset steps

Passphrase tips

1/4Policy: "All accounts must use strong authentication." Short, approved by leadership, rarely changes.

The big ideas

What you need to know

Short and readable

A policy nobody reads protects nobody. Keep it to a few pages in plain language, with the why stated clearly.

Owned and approved

Each document has an owner and leadership sign off. That gives it authority when someone asks "says who?".

Reviewed on schedule

Review at least yearly and after big changes. An old procedure that names a tool you retired is worse than none.

Procedures are testable

A good procedure is so clear that a new joiner could follow it at 2 am during an incident.

Save yourself the pain

Common mistakes

Oops

Copying a 40 page policy template from the internet unchanged.

Do this instead

Templates are a starting point. Cut what does not apply and match the real tools and teams you have.

Oops

Writing exact tool settings inside the policy.

Do this instead

Keep the policy high level and put settings in standards or procedures, so you do not need board approval for every tweak.

Your mission

Write a one page policy

~35 min

Quick check

"Help desk must verify identity with a callback to the registered number before any password reset" is best described as:

Go deeper

1Draft a short security policy (e.g. acceptable use) and a matching procedure document.
2Learn the difference between a policy (high-level, rarely changes) and a procedure (detailed, updated often).
3Understand why unenforced or unread policies provide little real security value.