A security policy is a formal written statement that defines what users can and cannot do with company assets, including computers, networks, programs, and data. Security policies are often included as part of an information security program and may be used to protect against unauthorized access or modification to sensitive data and systems.
A security policy is also sometimes referred to as a security standard or security standardization.
The process of developing a security policy begins with the creation of a risk assessment. This involves identifying the assets (i.e. resources) that need protection, determining what risks these assets face from threats (i.e. possible losses), and determining how best to prevent or mitigate those risks.
There are many ways to assess risk, but one common approach involves using a risk matrix like the one below:
Once risks have been identified and prioritized, they can be mitigated by implementing controls such as policies, procedures, standards, guidelines or frameworks that help ensure that those risks do not materialize into incidents (i.e., events resulting in undesired outcomes). The goal of implementing controls is not only to reduce risk but also to increase organizational efficiency by reducing administrative overhead associated with monitoring compliance with policies.
