Security Policies and Why Policies Should Be Developed
What is a Security Policy? (In Simple Words)
Buying the world’s most expensive Firewall or Antivirus is useless if an employee sets their password to "123456" or copies confidential company databases onto a personal pen drive!
An Information Security Policy is a formal, written document approved by top management that clearly defines the rules, responsibilities, and acceptable behaviors for employees, contractors, and users to protect the organization’s computers, networks, and data.
💡 Real-Life Analogy:
Think of your College Rulebook (Code of Conduct). It states that students must wear ID cards, maintain 75% attendance, and not use mobile phones in the exam hall—and specifies the penalty if someone breaks the rules. Similarly, a Security Policy is the “Cyber Rulebook” of a company!
1. Why Should Security Policies Be Developed? (Need & Importance)
This is a direct syllabus question in DAVV BCA Unit 5: “Why should security policies be developed?”
Here are the 8 major reasons:
- Sets Clear Rules for Employees (Eliminates Confusion):
Employees clearly know what they can and cannot do on office laptops (e.g., “Do not install pirated software” or “Do not share OTPs/passwords”). - Protects Against Human Error and Insider Threats:
Since human carelessness is the #1 cause of cyber breaches, policies enforce safe habits like locking screens when leaving desks. - Ensures Consistency Across the Entire Company:
Without a written policy, the HR department, Finance department, and IT department would each follow different security rules. - Legal Protection and Disciplinary Action:
If an employee steals data or misuses company internet, the company can take legal or disciplinary action only if a written policy was signed by the employee earlier! - Regulatory Compliance (ISO 27001, IT Act 2000, RBI):
Government laws and international standards legally require companies to maintain documented security policies. - Guides Technical Configuration:
Tells network engineers how to configure firewalls, password expiry rules, and database backups. - Defines Roles and Accountability:
Clearly states who owns the data, who can approve access, and who is responsible during an emergency. - Builds Customer and Client Trust:
Foreign clients and banks only sign contracts with IT companies (like TCS, Infosys, Wipro) that have strong, audited security policies.
2. The Hierarchy of Security Documents (Policy vs. Standard vs. Guideline vs. Procedure)
In an organization, security documentation is organized in 4 levels:
3. Three Major Types of Security Policies (NIST Classification)
According to NIST SP 800-14, organizational security policies are divided into 3 levels:
| Policy Type | Full Name | Purpose & Example |
|---|---|---|
| 1. EISP | Enterprise Information Security Policy (Program Policy) | High-level master policy signed by the CEO/CISO that sets the overall security vision, compliance goals, and responsibilities for the entire organization. |
| 2. ISSP | Issue-Specific Security Policy | Focuses on one specific activity or technology used by employees. Examples: WWW (Internet) Usage Policy, Email Security Policy, BYOD (Bring Your Own Device) Policy, Password Policy. |
| 3. SSSP | System-Specific Security Policy | Technical rules written for one specific server, firewall, or database. Examples: Access Control List (ACL) rules for the Payroll SQL Server or Cisco Router configuration policy. |
💡 DAVV Exam Preparation Tips
10-Mark Question: “What is a Security Policy? Explain why security policies should be developed and discuss the different types of security policies.”
- Define Security Policy in simple words using the College Rulebook analogy.
- List the 8 reasons why policies should be developed (Clear direction, reducing human error, legal protection, compliance, consistency, accountability).
- Draw the 4-level Document Hierarchy (Policy → Standard → Procedure → Guideline) and the 3 Policy Types table (EISP, ISSP, SSSP).