5.1a security policies ·

Security policy (general)

Documented rules covering both broad goals and detailed procedures, existing to support CIA (Confidentiality, Integrity, Availability).

Information security policy

The master document or list of all policies an organization must follow to maintain security and availability.

AUP (Acceptable Use Policy)

Defines what employees are and aren't allowed to do with company-provided technology; also serves as legal protection/documentation if someone is disciplined or terminated for violations.

Business continuity policy

Plan for continuing operations when normal technology or processes are unavailable, e.g. manual credit card processing when the network is down.

Disaster recovery plan

A broader, organization-wide version of business continuity, covering larger-scale disasters: natural, technological, or human-caused.

Business continuity vs disaster recovery

BCP keeps critical business functions operating during disruption (business-focused). DRP specifically restores IT systems and infrastructure after a disaster (technical-focused), often a subset of the overall BCP.

Disaster recovery components

Alternate recovery location, data recovery method, application restoration, staff availability at the recovery site.

Security incident policies

Documented procedures for handling specific incident types: malware infections, DDoS/botnet attacks, data exfiltration.

Incident response roles

Incident response team, IT security management, compliance officers, technical staff, and the general user community all play distinct roles in handling incidents.

SDLC (Software Development Lifecycle)

The structured process of moving from an idea to a deployed application: requirements, development, testing, deployment.

Waterfall (SDLC model)

Linear, sequential lifecycle: requirements, development, testing, deployment, maintenance, each phase completed before the next begins.

Agile (SDLC model)

Faster, iterative lifecycle: design, develop, test, deploy, and review repeatedly in cycles rather than a single linear pass.

Change management

Formal process for making any modification, with documentation of frequency, duration, install process, and a fallback/rollback plan.

Change management neglect risk

Skipping formal change management is common and can have serious negative organizational impact.