Certified Information Security Manager (CISM)Information Security GovernanceMedium
A CISO is reviewing the organization's information security policy framework. The organization has grown rapidly, and its existing policies are highly detailed and prescriptive, making them difficult to update and apply consistently across diverse new business units. Which of the following approaches would BEST address this challenge while maintaining effective governance?
- ACreate separate, highly specific policy documents for every new business unit.
- BOutsource all policy creation and management to a third-party consulting firm.
- CFreeze all policy updates for the next year to allow business units to catch up.
- DAdopt a principles-based policy framework, supported by detailed standards and guidelines.
Show answer & explanationAnswer & explanation
Correct answer: D. Adopt a principles-based policy framework, supported by detailed standards and guidelines.
A principles-based policy framework provides high-level, enduring security mandates that remain relevant despite organizational changes. These principles are then supported by more agile, detailed standards and guidelines that can be updated more frequently and tailored to specific business unit needs, offering flexibility without sacrificing governance.
Why the other options are wrong
- A. Creating too many separate, highly specific policies would exacerbate the management and consistency issues.
- B. While consultants can assist, outsourcing the entire policy creation and management can lead to a lack of internal ownership and understanding.
- C. Freezing policy updates would lead to outdated policies, increased risk, and non-compliance in a rapidly changing environment.
Principles-Based Policy Framework
An information security policy structure that defines high-level, enduring security principles, which are then supported by more detailed and flexible standards, guidelines, and procedures.
- Provides flexibility and scalability.
- Ensures long-term relevance of policies.
- Facilitates adaptation to changing technology and business needs.
Memory trick: Principles are the tree trunk, standards are the branches.