AN INFORMATION TECHNOLOGY (IT) security policy framework is the foundation of an organization’s information security program. The framework consists of a library of documents. A policy framework is much more than “just” a collection of documents. Organizations use these documents to build process, determine acceptable technologies, and lay the foundation for enforcement. The security policy framework documents and their implementation express management’s view of the importance of information security.

Security policy frameworks can be large and complex, with significant impacts to the organization. Implementation requires strong management support and good planning. There are many individual tasks and issues to resolve along the way. Maintaining a clear line of communication with the executives who demonstrate support for and, ideally, personal commitment to the implementation is important. The implementation is not complete when a policy framework is published. The framework must define the business as usual (BAU) activities and accountabilities needed to ensure information security policies are maintained. You can measure success by how well the framework helps reduce risk to the organization. Implementing the framework is one of the first steps in managing information security risks.

Organizations cannot afford to be reactive or operate in an ad-hoc fashion regarding information security. There’s increased accountability and liability with regulations. There’s increased demand from senior leadership to demonstrate value. There’s a push from security professionals to measure success. However, before you can measure anything, you need a benchmark. A benchmark allows you to gauge if you’ve reasonably covered the risks. It’s something you can measure against to demonstrate value. The benchmark, and that gauge of success, is a part of the security framework. It captures the experience and knowledge of security professionals from all over the world. It provides a road map to guide an organization through the maze of security issues.

This chapter covers the components of an IT security policy framework. It also helps you understand how to create a framework that meets your organization’s needs. The chapter covers the business and assurance consideration, and also discusses the issues with unauthorized access and their ramifications. Through these discussions you will better learn the value and construction of security frameworks.