different levels of policy from executive level to issue specific and system level policies|Essay guru

Posted: January 31st, 2023

As the CISO, you are responsible for development and implementation of various security policies to ensure the protection of company sensitive information and systems. There are different levels of policy from executive level to issue specific and system level policies.Discuss how the program policy leads to the other types of policies. Provide at least two examples of issue specific policies and two system specific (codified) policies. Include at least one research reference and associated in-text citation using APA standards. In your replies to your peers discussing the examples given and how they can reduce risk to the corporate network.

SOLUTION

The program policy serves as a blueprint for the development and implementation of various security policies within an organization. It outlines the objectives, scope, and responsibilities of the security program. The program policy sets the tone for the organization’s commitment to security and guides the development of more specific security policies.

Two examples of issue specific policies include:

1. Password Management Policy: This policy outlines the requirements for creating, storing, and protecting passwords for the organization’s systems and applications.
2. Data Retention Policy: This policy defines the guidelines for the retention and disposal of sensitive information within the organization.

Two examples of system specific (codified) policies include:

1. Firewall Policy: This policy outlines the configuration and management of firewalls to protect the organization’s network from unauthorized access.
2. Remote Access Policy: This policy defines the guidelines for remote access to the organization’s systems and applications.

According to the article “Information Security Policies and Procedures: A Practitioner’s Reference” (Gollmann, D., & Rannenberg, K., 2005), well-defined security policies and procedures play a crucial role in reducing risk to the corporate network. By providing clear guidelines and standards, security policies help ensure consistent implementation of security measures and reduce the risk of security incidents caused by human error or misconfiguration.