Information Security Policies (ISO 5)

Table of Contents

• #Overview | #Standards | #Getting Started | #Resources
• Management Direction for Information Security (ISO 5.1)

Overview

Adoption of one or more information security policies is how an institution of higher education expresses intent with regards to information security requirements and expectations. Policy governance involves a Board of Trustees or the executive management of an institution showing evidence of their intent to secure information, to provide guidance and governance of the information security program, and of the institution's core belief in the importance of efforts to secure information.​

Within such a policy, institutional leaders are able to set a clear plan for information security, describing its important role in supporting organizational goals, as well as compliance with relevant laws and regulations. It can additionally set out operating plans and processes to arrive at the institution's goals for information security. The policy can also establish required standards, behaviors and outcomes, depending on the specificity sought.

In the context of higher education, the overarching security policy document is often (though not always) arrived at through a consensus building process; with solicitation and feedback from parties within an institution's governance structure. Once established, effectively communicating, maintaining and updating the security policy ensures that the stated intent and corresponding community expectations are consistent and maintain their relevancy over time to reflect changes in technology, laws, organizational approach, and other factors.

#Top of page

Standards

#Top of page

#Top of page

Management Direction for Information Security (ISO 5.1)

• Define what information security means to the institution,
• Express leadership support for the role of information security in the carrying out of the institution's missions,
• Define roles and responsibilities
• Describe mechanisms for ensuring the appropriate security of institutional information resources including the management and mitigation of risks, and
• Outline the standards and procedures to be followed.

NOTE: A careful balance must be reached to ensure that the policy enhances organizational security by providing enough detail that community members understand their expected role & contribution, but not so much detail that the organization is exposed to unnecessary risk.

#Top of page

Policies for Information Security (ISO 5.1.1)

If a policy is a statement of intent (according to most definitions), then a policy for information security can be defined as a formal high-level statement that embodies the course of action adopted by an institution regarding the use and safeguarding of institutional information resources.  The policy statement should clearly communicate the institution's beliefs, goals, and objectives for information security. 

To be effective an information security policy should:

• Focus on desired behaviors (e.g., acceptable use) and outcomes (e.g., preservation of confidentiality and integrity of information)
• Require compliance (i.e., it should be mandatory to the intended audience)
• Be enforceable.  (i.e., failure to comply should result in disciplinary actions)
• Be defined and informed by standards, best practices, and guidelines

Review of Information Security Policy (ISO 5.1.2)

To ensure that policies are kept up to date and that they are still required and appropriate, it is recommended that an owner is defined for each policy. The role of the owner of the policy will develop, review and evaluate a policy. The owner should identify a regular interval to review the policy or should review the policy when changes in regulations or technology directly impact the policy. Changes in the organization or business practices would also require policy be modified. 

If changes are made to existing policy, these policies should be obtained by the appropriate governing entity. 

#Top of page

Resources

Questions or comments? Contact us.

Except where otherwise noted, this work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0).