Sample Information Security Policy

I. POLICY

A. It is the policy of ORGANIZATION XYZ that information, as defined hereinafter, in all its forms--written, spoken, recorded electronically or printed--will be protected from accidental or intentional unauthorized modification, destruction or disclosure throughout its life cycle. This protection includes an appropriate level of security over the equipment and software used to process, store, and transmit that information.

B. All policies and procedures must be documented and made available to individuals responsible for their implementation and compliance. All activities identified by the policies and procedures must also be documented. All the documentation, which …show more content…

Specific responsibilities include:

1. Ensuring security policies, procedures, and standards are in place and adhered to by entity.

2. Providing basic security support for all systems and users.

3. Advising owners in the identification and classification of computer resources. See Section VI Information Classification.

4. Advising systems development and application owners in the implementation of security controls for information on systems, from the point of system design, through testing and production implementation.

5. Educating custodian and user management with comprehensive information about security controls affecting system users and application systems.

6. Providing on-going employee security education.

7. Performing security audits.

8. Reporting regularly to the ORGANIZATION XYZ Oversight Committee on entity’s status with regard to information security.

B. Information Owner: The owner of a collection of information is usually the manager responsible for the creation of that information or the primary user of that information. This role often corresponds with the management of an organizational unit. In this context, ownership does not signify proprietary interest, and ownership may be shared. The owner may delegate ownership