Ruslan Rakhmetov, Security Vision
When working in modern companies, employees often hear the phrase ‘information security policy’, but often even IT specialists do not always understand what it means. Someone understands IS policies as a set of internal rules and requirements, someone - as settings of devices and servers in the domain, and someone - as just an incomprehensible document with a lot of technical terms, which should have been read by signature on the first working day. In this article we will tell you what is the enterprise information security policy, give practical examples and tips on how to develop this document.
So, as we have already written earlier, the information security policy of a company is a documented, agreed and approved set of interrelated high-level principles of information protection, in accordance with which IS processes are built in the company. Thus, it is the corporate IS policy that defines all technical, organisational and physical cybersecurity measures applied in the company, while all other internal regulatory documents (hereinafter referred to as IRD) - standards, regulations, procedures, instructions - cannot contradict the provisions of the IS policy and are used to detail the requirements set out in it.
Cybersecurity processes that are aligned with the requirements of the IS policy form a coherent and harmonised structure called the information security management (or management/assurance) system, abbreviated as ISMS (or ISMS/JIS). This system consists of IS IAPs and their corresponding allocated resources, activities and implemented countermeasures, which are managed by the company in order to protect information assets. Various frameworks and standards can be used to implement an ISMS, but the recognised global best practice is to follow the provisions of ISO/IEC 27001:2022 ‘Information Security Management Systems - Requirements’, part of the ISO/IEC 27000 series of standards. Building an ISMS in accordance with this standard implies a systematic approach to developing, implementing, monitoring, maintaining and improving a company's cyber defence to achieve its business objectives based on a corporate cyber risk management system. The key components of the ISMS are the processes of managing the implementation of the IAP, professional development of IT/IS specialists, IS awareness of employees and managers, planning of IS activities, implementation of protective measures, current activities of the IS department, evaluation of the effectiveness of the ISMS and IS department, evaluation of results by the management, and improvement of the ISMS.
Successful implementation of an ISMS is based on a number of key provisions that can be prescribed in the IS policy:
- Analysing the cyber security requirements for information assets and applying appropriate adequate protection measures;
- Understanding the need for and importance of IS among the company's managers and employees;
- Assigning responsibility for IS assurance;
- Conducting a cyber risk assessment to select the necessary measures to mitigate risks to acceptable levels;
- Integrating defence measures as integral elements in information systems and networks;
- Proactively preventing and detecting IS incidents;
- Ensuring a comprehensive approach to IS management;
- Continuous monitoring and evaluation of IS status, making changes to the ISMS when necessary.
ISO/IEC 27001:2022 states that the IS policy should be documented and approved by the company's CEO, published and communicated to the company's employees, should be consistent with the company's business objectives, define the objectives of the company's IS processes, contain commitments to fulfil IS requirements and continuously improve the company's ISMS, and should be reviewed and updated at specified intervals or in case of significant changes in the business, corporate infrastructure, threat landscape. The objectives of IS processes, in turn, should be consistent with the IS policy, controlled and measurable where possible, take into account applicable IS requirements and the results of risk management processes, and be updated as necessary. When planning IS processes, it is important to determine in advance what needs to be done to achieve the objectives, what resources are required to achieve them, set deadlines for achieving the objectives and select methods for evaluating the results, and assign responsibilities.
Annex ‘A’ of ISO/IEC 27001:2022 provides a reference non-exhaustive set of different safeguards and controls that can be implemented to minimise the cyber risks identified in a company - these can also be summarised in an IS policy by listing the main organisational, physical, technical and personnel controls. In general, an IS policy should spell out the high-level provisions, principles and concepts that guide the company to ensure its cyber security.
For example, an IS policy might list the following principles and concepts:
- Compliance of the ISMS with current legislation;
- Business-centricity of the ISMS;
- Ensuring IS without disrupting the company's business processes;
- Provision of IS for all protection objects at all stages of their life cycle;
- Classification of protection objects and prioritisation of protection measures;
- Economic feasibility of applied protection measures;
- Responsibility and understanding of IS requirements by employees and managers of the company;
- Interaction and coordination of efforts between employees and managers of the company's structural units, as well as with external parties (regulators, contractors, communities, industry associations, etc.);
- Granting the least authorisation to users of information systems;
- Granting privileged (administrative) powers only for specific official actions and only for a certain time period;
- Providing access to information only if there is a justification for the use of data, familiarisation with the information, connection to the information system, in the presence of approval for access and performance of actions from the direct supervisor;
- Separation of powers in the form of impossibility to perform critical actions by one person;
- Timely updating and revocation of authority;
- Segmentation and control of access to data using the ‘Zero Trust’ approach;
- Encryption of information during storage and transmission;
- Application of Assumed Breach approach;
- Aligning the ISMS with an echeloned defence strategy;
- Continuous Improvement and a process-based PDCA approach to IS assurance and ISMS operation.
The following may also be included in the IS policy:
- Applicable legislation - e.g. requirements of 149-FZ, 152-FZ, 187-FZ, 98-FZ, etc.;
- List of protected objects - for example, information resources, information infrastructure elements, software and hardware, business processes, premises, employees and managers of the company;
- IS threats relevant to the company - accidental and intentional threats, e.g. unauthorised access to information, data leakage, disabling of infrastructure, inaccessibility of information, etc.;
- Categories of actual perpetrators with their capability levels - e.g. insider, hacktivist, competitor, APT group, lone hacker, etc.;
- Possible negative consequences from the realisation of cyber threats - direct and indirect damage, qualitative and indirect losses, e.g. lost profits, customer churn, embezzlement of money, loss of reputation, etc.
It should be noted that the work of a new cybersecurity manager in a company usually begins with the development of an IS policy. Therefore, it is important that this document not only be written in clear language and agreed upon by the company's management, but also become a high-level guideline for implementing effective IS in the company. It is important that, following the development and approval of the IS policy, the new cybersecurity manager takes a number of steps to improve the company's actual cyber security, demonstrates tangible results, and builds a dialogue with business units and key employees. In each specific case, the content of the IS policy and the list of priority steps to improve the level of security will differ, as companies are characterised not only by their size and lines of business, but also by their risk profiles and the attitude of managers and owners to cyber risk management.
However, it is possible to suggest a tentative list of steps that would be appropriate for a new IS manager in a typical medium-sized private company:
- Studying the company's business structure, including its core assets and business processes, building interactions with business units, their managers and key employees;
- Studying the company's information and network infrastructure, technologies used, available security features, building interaction with the IT department and specialists (administrators, network engineers, developers, technical support);
- Analysing legislative norms applicable to the company in terms of information protection, building interaction with the legal block on issues of compliance with the legislation;
- Identification of current IS threats and cyber risks that need to be minimised in accordance with the decision of the risk committee (or similar corporate structure);
- Drawing up a list of IS requirements dictated by the cyber risks to be minimised, current IS threats, and legal requirements;
- Selection of appropriate industry and international frameworks, standards, recommendations and best practices for building IS processes in the company;
- Development and approval of the IS policy, further - gradual development of other IAPs, including corporate IS standards, detailed regulations, procedures, instructions on IS;
- Drawing up a list of necessary protection measures (organisational, technical, physical) that cover the identified IS requirements;
- Analysing the existing protection measures (including protection systems) to ensure that they fulfil the identified IS requirements;
- Selection of new protection measures (including PPE) and/or modernisation of old ones, assessment and economic justification of the relevant costs, budget coordination;
- Recruitment of employees in the IS department to work with specific technologies and protection systems;
- Implementation of protection measures, including acquisition (development), implementation, initial configuration of protection systems by contractors or independently;
- Conducting IS training for employees and managers of the company on a regular basis and when hiring new employees, advanced training of IT/IS specialists within the framework of the corporate competence management programme;
- Control over the implementation of IAPs with the help of ISPs, control over minimisation of cyber risks to the specified level;
- Continuous improvement of the ISMS, adaptation of protection measures to the changing IS threat landscape and newly identified cyber risks, fine-tuning and updating of protection measures, coverage of a wider range of business processes with protection measures.
