Stop 04 · Core Security ConceptsTopics · 8/10

Security Policies & Standards

In short

Firewalls and antivirus follow rules that someone wrote down first. Policies and standards are those rules, and auditors, customers and laws increasingly ask to see them.

Written organizational rules governing acceptable use, password requirements, and incident handling — the documented foundation that technical controls are built to enforce.

The blob as a cricket umpire holds a thick rulebook and raises a finger.

Think of it like this

The cricket rulebook and the umpire

The laws of cricket are written once and apply to every match. The umpire doesn't invent rules on the field, he applies the book. Security policies are the rulebook, and technical controls are the umpires that enforce them.

Watch it happen

From big rule to daily steps

Policy

Standard

Procedure

Guideline

1/4Policy: the high-level 'what' and 'why'. 'All company accounts must use strong authentication.' Approved by leadership.

The big ideas

What you need to know

Common policies

Acceptable use, access control, password, data classification, incident response and backup policies.

Frameworks to borrow from

ISO 27001, NIST CSF, CIS Controls and PCI DSS give you tested structures instead of starting blank.

Laws add requirements

In India, CERT-In directions require reporting certain incidents within 6 hours, and the DPDP Act governs personal data.

Enforce and review

A policy nobody follows is worse than none. Back it with technical controls and review it yearly.

Save yourself the pain

Common mistakes

Oops

Copying a 60-page template nobody will read.

Do this instead

Write short, clear policies people can follow. Put detail in standards and procedures.

Oops

Writing rules the technology can't enforce.

Do this instead

Pair each rule with a control, like MFA settings in your identity provider, and evidence you can show an auditor.

Your mission

Write a one-page policy

~35 min

Quick check

'Laptops must use full-disk encryption with AES-256' is best described as a...

Go deeper

1Read a public example of an acceptable use policy or password policy.
2Learn why a technical control without a corresponding policy often lacks organizational backing.
3Understand policies are enforced through both technology and training (Phase 11).