THE ENFORCEMENT OF A SECURITY POLICY begins when the hard work of creating the policy and providing initial security awareness is done. All the effort put into creating the policy is of little value if it’s not followed. Essentially, a policy that is not enforced is the same as no policy at all. A compliance program is essential to ensure that policies are adopted and deliver intended value. Quality assurance and quality control reviews (sometimes referred to as compliance reviews) and vulnerability assessments are three important components of a compliance program.

A quality assurance (QA) review ensures that the security policy is adopted before an action is taken. For instance, ensuring that security is properly coded before a piece of software is moved to production is an illustration of quality assurance. In contrast, quality control (QC) reviews and vulnerability assessments are performed after the environment is built. A QC review determines if policies are being followed. The vulnerability assessment is used to measure the effectiveness of the policies. If everyone follows the policies, then the number of vulnerabilities declines. If the number of vulnerabilities does not decline, the fault lies with either individuals or poorly designed policies. Vulnerability assessments need to be aligned with business goals. The level of enforcement needs to align to the level of risk.

How you implement a compliance program will depend in part on your organization’s governance and management structure. This organizational structure defines how a company sets and follows a strategic course. The structure also can be leveraged to enforce IT security policies.

This chapter reviews the organizational and technical methods of enforcing security policies. It discusses the importance of executive support for the enforcement process. It discusses specific roles in the organization. The chapter also discusses legal considerations when enforcing security policies. It then ends by illustrating the points made through a discussion of best practices and case studies.