2.8 Security Policy and Procedures

Security Policies Set the Rules

A security policy is a formal, documented set of rules describing how an organization protects its assets, data, and systems. Policies define expectations for employees, such as acceptable use policies (AUP), password requirements, and data handling rules. Policies are high-level and rarely change; they establish *what* must be done, not *how*.

Procedures Explain the How

Procedures are step-by-step instructions for carrying out a policy's requirements, such as how to reset a password or report an incident. Unlike policies, procedures are detailed, practical, and updated more frequently as technology and threats evolve. Together, policies and procedures create consistent, repeatable security practices across an organization.

Enforcement and Compliance

Policies only work if they are enforced and communicated to all staff through training. Organizations use audits, monitoring, and compliance checks to ensure policies are followed. Consequences for violations (like disciplinary action) must be clear. Well-written policies also help organizations meet legal and regulatory requirements.

Key terms

Security policy

A formal document defining high-level rules for protecting an organization's assets and data.

Procedure

Step-by-step instructions describing how to carry out a security policy's requirements.

Acceptable Use Policy (AUP)

A policy defining how employees are allowed to use organizational systems and resources.

Compliance check

A review process to confirm that policies and procedures are being followed correctly.

Why train employees on policies?

Training ensures staff understand and correctly follow security rules, reducing risk and errors.

Try an AP-style question

An acceptable use policy (AUP) defines…

1. which ports are open
2. how to encrypt a drive
3. how firewalls filter packets
4. how users may use company systems