Security policies, standards, procedures and ISO/IEC 27002

What a security policy is

A security policy is a formal, management-approved document that states how an organisation protects its information: what is protected, who is responsible, what is expected of staff and what happens if rules are broken. A good policy is clear, realistic, enforced, communicated to everyone and reviewed at least once a year.

Policy, standards, procedures and guidelines

Common security policies

• Acceptable use: what staff may and may not do with IT systems, email and the internet.
• Password and authentication: length, MFA, no sharing, how resets work.
• Access control: least privilege, joiners, movers and leavers, regular reviews.
• Remote access and mobile devices: VPN, device encryption, bring-your-own-device rules.
• Backup and data handling: classification, retention, secure disposal.
• Incident response: how to report and handle security incidents.

From ISO 17799 to ISO/IEC 27002

ISO 17799 was renamed ISO/IEC 27002 in 2007. It is a catalogue of recommended security controls; its partner ISO/IEC 27001 defines the management system an organisation can be certified against. The current edition (2022) groups 93 controls into four themes: organisational, people, physical and technological.

Key control areas from ISO/IEC 27002

• Physical and environmental: secure areas and entry controls, equipment siting and protection, supporting utilities such as power, cabling security, secure disposal or reuse of equipment, clear desk and clear screen.
• People (human resources): screening before employment, security responsibilities in contracts, awareness training, a disciplinary process, and removing access and returning assets when people leave.
• Access control: a documented access control policy, formal user registration and removal, managing privileged rights, reviewing access regularly, secure log-on and password management, and restricting access to source code and system utilities.

Real-world example: from policy to procedure in a manufacturing firm

A manufacturing company with 150 staff wrote an access control policy, approved by the managing director, saying that every user must have a unique account and only the access their job needs. Under it, the IT team wrote a standard stating that passwords must be at least 14 characters and MFA is required for email and remote access. A procedure then set out the exact steps for new starters: HR raises a request, the line manager approves the access, IT creates the account and records it. A guideline suggested using passphrases made of several random words.

When an auditor asked how leavers were handled, the firm could show the matching leaver procedure and the ticket for each account it had disabled, which mapped directly to the access control area of ISO/IEC 27002.