How to create a continuous lifecycle for your IT Policy Management

If your organization is having trouble creating policies, I hope that this blog post will help you set a clear path. We’ll discuss setting up your organization up for success by ensuring that you do not treat your policies as a “do once and forget” project. Many organizations I have worked with have done that, but later realized good policy lifecycle is required, and a pillar of good governance.

Organizations often feel that developing and enforcing policies is bureaucratic and tedious, but the importance of policies is often felt when your organization does not have them. Not only are they a cost of doing business, but they are also used to establish the foundation and norms of acquiring, operating, and securing technology and information assets.

The lifecycle, as it implies, should be iterative and continuous, and policies should be revisited at a regular cadence to ensure they remain relevant and deliver value to your business.

 Assess

The first step is to find out where your organization is, this step should shine a light on where, and what gaps exist.

First, determine how you will be assessing your policies; here is a checklist, whether you are building new ones or bringing current ones up to date:

• Is it current and up to date
• Does it have a clear purpose or goal
• Does it have a clear scope (inclusions /exclusions)
• Does it have a clear ownership
• Does it have a clear list of affected people
• Does it have language that is easy to understand
• Is it detailed enough to avoid misinterpretations
• Does it follow the laws/regulations/ethical standards
• Does it reflect the organizational goals/values and culture
• Are key terms and acronyms defined
• Have related policies and procedures been identified
• Are there clear consequences for non-compliance
• Is it approved and supported by management
• Is it enforceable

Next, inventory your organization’s policies by listing them and then assessing the quality using the previous list. Based on the quality, identify if your organization needs new policies or if the existing ones need improvement, then determine the amount of work that will be required.

Best practices suggest that you may want to prioritize your efforts on the most significant improvements, those that focus on the most serious business vulnerabilities.

Understand that policy improvement does not end with a new policy document. You will need to plan for communications, training, process changes, and any technology improvements needed to make the policy fair and enforceable.

Develop

After the assessment is done, you should plan on developing your policies or revamping the old ones. Although there is no consensus on what makes a good policy, referenced material [1] [2] [3] [4] suggests the following best practices, policies should have a clear purpose and precise presentation that drives compliance by eliminating misinterpretations;

All policies should include and describe the following:

• Purpose
• Expectations
• Consequences
• Glossary of terms

For maximum effect, policies should be written:

• With everyday language
• With direct and active voice
• Precisely to avoid misinterpretation
• Realistically
• Consistently in keeping with standards

Consider that policies need to be actively sold to the people who are supposed to follow them. You can achieve that by using a communication plan that includes:

• Goals and objectives
• Key messages
• Potential barriers
• Suggested actions
• Budget considerations
• Timelines

Enforcement

A lack of enforcement will create ethical, financial, and legal risks to any organization. Among the risks are loss of productivity due to abuse of privileges, potential wasted resources, and loss of reputation if an employee engages in illegal activities due to poor policy enforcement, which can lead to potential litigation. Make sure that you have clear rules of engagement.

Your organization should establish the proper support framework around Leadership, Process, and Monitoring. Policies should perform against standards. Policies don't always fail due to bad behavior; they fail because:             

• They are poorly written
• There is no enforcement
• They are illegal or unethical
• They are poorly communicated
• They go against company culture

If your company feels overwhelmed thinking about all the moving pieces that make up an IT Policy Management Lifecycle. Let LevelBlue Consulting help whether you need to amend existing policies, implement one or more brand new policies, or need a complete overhaul of the entire policy portfolio.

References

1) F. H. Alqahtani, "Developing an Information Security Policy: A Case Study Approach," Science Direct, vol. 124, pp. 691-697, 2017.

2) S. Diver, "SANS White Papers," SANS , 02 03 2004. [Online]. Available: https://www.sans.org/white-papers/1331/. [Accessed 15

3) S. V. Flowerday and T. Tuyikeze, "Information security policy development and implementation: The what, how, and who," Science Direct, vol. 61, pp. 169-183, 2016.

4) K. J. Knapp, R. F. Morris, T. E. Marshall and T. A. Byrd, "Information security policy: An Organizational level process model," Science Direct, vol. 28, no. 7, pp. 493-508, 2007.