Security Policies & Procedures

Summary

Writing the documented rules and step-by-step processes that operationalize a security program — a policy states the 'what' and 'why', a procedure details the specific 'how'.

• 1Draft a short security policy (e.g. acceptable use) and a matching procedure document.
• 2Learn the difference between a policy (high-level, rarely changes) and a procedure (detailed, updated often).
• 3Understand why unenforced or unread policies provide little real security value.