IT Security Policy

The documentation of IT security decisions in an organization.

NIST SP 800-12 categorizes IT Security Policy into three basic types:

• 1) Program Policyhigh-level policy used to create an organizations IT security program, define its scope within the organization, assign implementation responsibilities, establish strategic direction, and assign resources for implementation.
• 2) Issue-Specific Policiesaddress specific issues of concern to the organization, such as contingency planning, the use of a particular methodology for systems risk management, and implementation of new regulations or law. These policies are likely to require more frequent revision as changes in technology and related factors take place.
• 3) System-Specific Policiesaddress individual systems, such as establishing an access control list or in training users as to what system actions are permitted. These policies may vary from system to system within the same organization. In addition, policy may refer to entirely different matters, such as the specific managerial decisions setting an organizations electronic mail (e-mail) policy or fax security policy.