Policy
What is Policy?
A formal statement of management intent and direction. Security policies establish the rules, expectations, and standards that guide an organisation's approach to information security.
Terms that appear alongside policy
Each of these is named in at least one of the same controls as policy. The number is how many controls name both.
- governance 96 shared controls
- compliance 95 shared controls
- audit 79 shared controls
- information security 74 shared controls
- nist 72 shared controls
- cybersecurity 60 shared controls
- privacy policy 44 shared controls
- access control 43 shared controls
Frameworks that govern policy
What the standards actually require on policy
Requirements naming policy across 6 standards, quoted from the control text.
Agencies should create, put into effect and keep up to date an RFID Usage Policy.
new-zealand-information-security-manual-nzism::11.6.61.C.01 · 11.6.61.C.01 RFID usage policy developed and maintained →Implement hardware-enforced separation and policy enforcement mechanisms between [Assignment: organization-defined security domains].
NIST800-SC-49 · SC-49 Hardware-enforced Separation and Policy Enforcement →Develop, document and disseminate to the responsible personnel an assessment, authorization and monitoring policy and its implementing procedures; designate personnel with information security responsibilities to manage them;
fbi-cjis-security-policy::CA-1 · CA-1 Policy and Procedures →The organisation implements hardware-enforced separation and policy enforcement mechanisms between defined security domains. No enhancements.
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-49 · SC-49 Hardware-enforced separation and policy enforcement →Keep approved logging and monitoring policies and procedures, and review them at least annually.
CCM-LOG-01 · Logging and Monitoring Policy and Procedures →Whenever an established policy is departed from, an approved exception process required by the governance programme is set up and followed.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::GRC-04 · Policy Exception Process →Questions people ask about policy
What is Policy?
Why is Policy important for compliance?
Which compliance frameworks address Policy?
Where can I learn more about Policy?
See how Policy applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.