3.1 ESTABLISH AN INFORMATION SECURITY POLICY

Establish an information security policy.

Make sure that your security policy provides clear direction.

Make sure that your information security policy shows that
your organization is committed to information security.

Make sure that your security policy shows that your organization is
prepared to support an ongoing commitment to information security.

3.1.1 DEVELOP AN INFORMATION SECURITY POLICY DOCUMENT

Document your information security policy.

Make sure that your information security policy document
has been formally approved by your senior management.

Publish your information security policy document.

Communicate your security policy to all employees.

Make sure that your information security policy
communications are easy for users to understand.

Make sure that your security policy communications
are relevant to your users’ needs and expectations.

Make sure that your security policy document makes it clear that
your senior management is firmly committed to information security.

Make sure that your policy document indicates that your management
supports your organization’s information security goals and principles.

Make sure that your information security policy document describes your
organization’s approach to the management of information security.

Make sure that your security policy document
provides a definition of information security.

Make sure that your policy document clarifies the scope
of your organization’s commitment to information security.

Make sure that your information policy document defines
your organization’s information security objectives.

Make sure that your security policy document highlights the information
security considerations that are especially important to your organization.

Make sure that your information security policy document
defines information security management responsibilities.

Make sure that your information security policy document
defines security incident reporting responsibilities.

Make sure that your security policy refers to other
documents that support your information security policy.

3.1.2 REVIEW AND EVALUATE INFORMATION SECURITY POLICY

Clarify who owns your information security policy.

Make sure that your security policy owner is responsible
for the review and evaluation of your security policy.

Define a security policy review and evaluation process.

Carry out periodic information security policy reviews.

Make sure that your periodic policy reviews evaluate
the effectiveness of your information security policy.

Make sure that your periodic policy reviews evaluate the
impact security controls are having on business efficiency.

Make sure that your periodic policy reviews evaluate
the effects that changes in technology are having.

Carry out a policy review whenever your security risks change.