Security Policies and Procedures - What's the Difference?

 Most organizations of any size have security policies. Typically the larger the organization, the more policy is necessary. What is relationship of policy to procedures?

Security policy is a set of high level directives. They define your overall security strategy. Think high level and strategic when you think policy. Policy rarely changes because it is high level. Without policy, you do not have a security plan. You might have lots of great security controls, but you do not have an overall plan and probably have holes big enough to drive a truck through.

Procedures on the other hand are tactical and lower level. They are step by step instructions to accomplish something. Typically for every policy there are one or more procedures. Procedures change far more often than policy typically, for example if the technology changes.

A policy may state something like "all systems must run up to date anti virus software." The procedures will contain details on how the anti virus software is installed and updated. There may be specific procedures for different systems of types of systems.

Policy should be short and written in plain English (or whatever language is appropriate). It should not be written in pseudo legalese and should be easy to read and unambiguous. I strongly prefer lots of short policies, perhaps one or two pages long, instead of a few longer policies.

Procedures are as long as they need to be. They are often updated and typically updating a procedure is an informal process. Updating a policy is in contrast a rather formal process. Legal may need to be involved, and certainly upper management is usually involved. Since policy rarely changes this is not much of a burden.

Harry writes on many topics including health, nutrition, and exercise. See his latest writings at Osterizer Blender Parts [http://osterizerblenderparts.com/] and Oster Food Processor [http://osterizerblenderparts.com/oster-food-processor.htm].

Article Source: https://EzineArticles.com/expert/Harold_Baldwin/301993

Article Source: http://EzineArticles.com/4471143