Security is a priority for all organisations. It covers many aspects of working life – the buildings we work in, the technology we use, the data we share with others, our professional behaviour and so on. Being safe in the workplace, cyber-security, data privacy, safeguarding confidential information and other related areas are topics that all employees need to be aware about. It’s also particularly important in some industry sectors.

Security is a big topic. But one of the challenges associated with ensuring security measures are in place is that if often relies on the awareness, knowledge and co-operation of employees. Only too often, employees and their carelessness are the cause of security issues, usually inadvertently but sometimes wilfully.

Because of this it is important to have security policies in place that provide clarity for employees on security and related matters.

To support the effective distribution of security policies, organisations must have active security policy management in place. In this article, we’re going to cover what a security policy is, why we need them and how they help minimise risk. We’ll also explore some of the different types of security policy as well as some good practice tips.

What is a security policy?

A security policy can be defined as any policy which helps to protect an organisation against security threats and vulnerabilities through risk prevention as well as processes to minimise any potential damage. It can cover both the security relating to a physical building as well as technology and digital channels, and include aspects such as overarching principles, specific procedures, terms of usage and staff training.

Why do you need security policies?

Security is a priority for every organisation. It’s an area where there is little room for compromise. Policies provide clarity and a critical backbone to ensure the right procedures are followed to maintain security and reduce the associated risks.

Specifically, policies help to:

• Prevent specific incidents by reducing vulnerabilities.
• Reduces and contain the potential damage when an incident occurs.
• Drives compliance with regulatory and legal requirements.
• Keep everybody safe, supporting an organisation’s duty of care to employees, customers and suppliers.
• Keeps client and employee data secure.
• Protect an organisation’s overall brand and reputation.

How do security policies help minimise risk?

More specifically, security policies help minimise risks in the following ways:

• They educate employees about the approaches to take and steps to follow to support security, and are particularly important in onboarding new starters.
• They keep employees up to date about any changes to security policies or procedures.
• They are an essential reference point, providing absolute clarity and a definitive source of truth relating to security.
• They support decision-making.
• They support various different processes such as recruitment, procurement, due diligence on technology purchases, employee onboarding and more.
• They can play a role in compliance-related reporting, particularly in regulated industries, and where standards such as ISO 27001 are important.
• The provide essential information on processes to follow if there is an incident, so are often related to disaster recovery planning and crisis management.
• They support the creation of new security policies and the review of existing policies.
• They provide information on expected behaviours for employees.
• They allow you take action against employees if they are putting security at risk through negligence or behaviour.

What are the different types of security policy?

There are many different types of security policy, with different aspects relating to scope, theme and type.

Scope

The scope of a security policy can vary. Sometimes they can be organisation-wide and more to do with general principles, for example, setting out a “zero trust” policy. Sometimes they can apply to something more specific such as a particular topic – for example relating to information management or building security. A security policy might also apply to something more granular like a particular building or a specific application or platform.

Theme

Security policies can cover different themes, including:

• The physical security of buildings and other assets.
• Cybersecurity principles and actions that must be followed.
• Data protection and privacy, ensuring the protection of client and employee data.
• Information management, covering sensitive and confidential information.
• Personal security for staff when travelling or undertaking work.
• Disaster recovery plans.
• And more!

Type

Security policies can also be of different types:

• General principles to follow.
• Detailed policy and procedures.
• A terms of usage policy.
• Guidelines for employees.
• Security, recovery or incident response plan to follow.
• Access control list on who can access which system.
• External security documents produced by a third-party such as a property management company or technical vendor.
• Part of employee training.
• One of more of all the above!

What are some good practices in managing security policies?

The kind of good practices that help manage your security policies are not necessarily that much different to managing other kind of policies. However, they are potentially more important as security policies are critical.

Clear ownership

Always establish clear ownership of a security policy with a named person or people who are responsible and accountable for keeping a policy up to date. Without that clear ownership, it is all too easy for a security policy not to be managed properly. In particular, sometimes ownership is attributed to a department or team; while clearly a department will have responsibility, naming the individuals helps ensure that a policy needing updating doesn’t get missed.

Version control

Version control is a central pillar of policy management. You can’t have two, three or more versions of the same policy in circulation as people may follow the wrong policy or process. It also undermines confidence and trust in policies. Always carry out robust version control with elements such as clear policy numbering and in providing access to only the latest version through your policy library. This is an area where a solution like Xoralia can help.

Regular reviews

Regular reviews of security policies by subject matter experts and policy owners is essential to ensure policies are always up to date. Having a regular review – say every six months – is important. It will also be important to have a review when there is either an external change such as a new IT system or a security incident as circumstances have changed.

Central access

Providing easy, central access to your security policies so everybody can find them is a must. This might be through a central policy library on your intranet or perhaps through relevant intranet pages covering IT, legal & compliance and more.

Employee attestation processes

Employee attestation processes are where people positively confirm that they have read and understood a policy, or an update to a policy. By managing this process, it adds an extra “nudge” to increase the likelihood of:

• new employees reading a policy
• all employees knowing that a policy has changed
• able to show regulators and other third parties that you are compliant in compliance areas where you need to show that employees are trained in and informed about areas relating to security.

Write policies so they can actually be used

No one is pretending that security policies are going to be the world’s most interesting or engaging documents, but all too often they are written in ways that make them hard to follow or make employees skip over sections.

Security policies are there to be followed. Use inclusive and accessible language, break documents up into steps so they are easier to follow, write additional guidelines, translate sections if necessary and more. Write a security policy that is there to be read and used by employees.

How Xorlia policy management software can help