What's Your Policy?

Does your company have written security policies? If not, your firm might be exposed to certain security risks. If employees don't know company security policies, they'll formulate their own—and their policies probably won't match the company's ideas of how employees should use time and resources. Poor employee decisions cost employers a lot of grief and often a lot of money.

Reading the FOCUS-MS security-related mailing list this week, I came across an interesting discussion: A list reader asked whether any security policy templates are available online. Several list readers provided links to sites that offer security policies and loosely structured policy models. The sites listed include the SANS Research Institute, Carnegie Mellon Software Engineering Institute (SEI), and Murdoch University in Australia. I found the security policy models on these sites very useful, so I want to pass these resources on to you. . . .