An organization’s collection of security policies, and therefore the entire security framework, shows its commitment to protecting information. As with security policies in general, a couple of considerations for implementing a framework are:

• Cost—Cost of implementing and maintaining the framework
• Impact—Impact of the controls required by the framework on employees, customers, and business processes

Creating a policy framework from the ground up takes time and effort. It’s important for management to budget for these expenses. In addition, as the number of documents in the framework grows, you may need a content management system to manage the documents. Many organizations already use Microsoft SharePoint Server or a similar product to manage all business-related documents. You can use the same system to manage documents in a policy framework.

Employees often resist change, especially changes that affect how they need to perform their jobs. However, a comprehensive policy framework can help employees do their jobs more efficiently. The framework includes guidelines that employees can follow and procedures that specify how to perform tasks. Essentially, a policy framework provides a structure within which employees can work more efficiently.

Adding a taxonomy and glossary of terms is critically important. A well-formed taxonomy becomes the “Rosetta stone” for the framework’s policy documents. It’s used to interpret the meaning of the policies and scope efforts. Let’s assume your policies include the terms platform and network infrastructure. What does platform mean? Do platform requirements include a firewall? Maybe. Maybe not. Yes, a firewall sits on a platform. There’s a physical box with an operating system. But the taxonomy and glossary of terms may define platform as devices upon which an application resides, such as application and database servers. All other nonapplication networked devices may fall under the definition of network infrastructure. In this case, for firewall controls, you would go to the framework’s network infrastructure documents. This distinction is not academic. Most likely the control requirements for platforms would be different from those for network infrastructure. And it is critically important to get the right controls for the different devices.

A policy framework also helps management adhere to compliance requirements. Your security policy framework enables you to show regulators that you are using best practices. Many regulations provide specific details that must be included in your security policies. It’s often helpful to create a “cheat sheet” that cross-references your security documents with the standards. For example, an entry might state that “HR Policy 2010-033 entitled ‘Pre-Employment Screening’ satisfies PCI DSS requirement 12.7.” This will come in very handy if you are ever audited; you can use the cheat sheet to show auditors the exact sections of policy that implement each requirement. The challenge is maintaining these cheat sheets. It’s important to build in a process of updating the cheat sheets whenever you revise the policies they’re based on.