Compliance with Security Program

I l @ ve RuBoard

Security policies are technology-independent descriptions of the security precautions that are required. They are generally defined as rules , which define specific bounds within which the system must operate , and guidelines , which ensure that security measures are not overlooked, even when they can be implemented in more than one way.

Security procedures define how to implement policies in respect to a specific technology. Procedures determine how standards should be implemented. Generally, they are written to apply to a class of systems that have similar attributes or security issues. Procedures must take into account the limitations of both the systems that are implementing them and current technology. Procedures are specific steps to follow that are based on the corporate security policy. Procedures are usually organized into standards, which define an acceptable level of security to which every system must adhere , and exceptions , which indicate specific instances where the standards will not be implemented. Exceptions require a definition of how the security issues, addressed by the standard which was not implemented, will be addressed.

I l @ ve RuBoard