Technology alone does not make an organization secure. Policies tell people what is expected, and frameworks give a proven structure for building a security program.

Policies, standards, procedures

These documents work as a layered set:

  • Policy: a high-level statement of rules and intent, approved by leadership (for example, “all laptops must be encrypted”).
  • Standard: specific required settings that satisfy the policy (for example, “AES-256 full-disk encryption”).
  • Procedure: step-by-step instructions to carry it out.
  • Guideline: optional recommended advice.

Common policies include an acceptable use policy, password policy, incident response policy, data classification policy, and a bring-your-own-device policy. A policy nobody enforces or can read is worthless, so good policies are short, clear and backed by training.

Controls

Security controls are grouped by type and by purpose:

  • Administrative: policies, training, background checks.
  • Technical: firewalls, encryption, MFA.
  • Physical: locks, cameras, badge readers.

By function they are preventive (stop it), detective (notice it), corrective (fix it) and deterrent (discourage it). Strong programs mix all of these, which is defense in depth.

Frameworks and regulations

  • NIST Cybersecurity Framework: organizes work into functions: Identify, Protect, Detect, Respond, Recover (newer versions add Govern).
  • ISO/IEC 27001: an international standard for an information security management system.
  • CIS Controls: a prioritized list of practical safeguards.
  • Regulations: laws such as FERPA (student records), HIPAA (health data), GDPR (EU personal data) and COPPA (children online) set legal duties.

Risk management ties it together: identify assets, find threats and vulnerabilities, estimate likelihood and impact, then choose to mitigate, transfer (insure), avoid or accept each risk. A simple model is risk = likelihood x impact.

Try it

Draft a one-page acceptable use policy for a school computer lab. Include purpose, scope, three allowed behaviors, three prohibited behaviors and consequences.

Check your understanding

1. Which document gives step-by-step instructions?

  • Policy
  • Standard
  • Procedure
  • Framework

Answer: Procedure. It details exactly how to perform a task.

2. Security awareness training is which kind of control?

  • Technical
  • Administrative
  • Physical
  • Corrective only

Answer: Administrative. It relies on people and management rather than hardware or software.

3. Which are the original NIST CSF functions?

  • Plan, Build, Test, Ship, Retire
  • Identify, Protect, Detect, Respond, Recover
  • Scan, Exploit, Pivot, Persist, Report
  • Encrypt, Hash, Sign, Verify, Store

Answer: Identify, Protect, Detect, Respond, Recover. These describe the lifecycle of managing cyber risk.

4. Buying cyber insurance for a risk is an example of:

  • Risk avoidance
  • Risk transfer
  • Risk acceptance
  • Risk elimination

Answer: Risk transfer. The financial impact is shifted to another party.

PreviousNext