Scribd Logo
Upload

Welcome to Scribd!

  • 178 views

    Enterprise Information Security Policy

    Uploaded by

    LiRose Smith
    An enterprise information security policy (EISP) sets the strategic direction for an organization's security efforts by assigning responsibilities to various areas of information security and guiding the development of security programs. The EISP directly supports the organization's vision and mission statements and is drafted by the chief information security officer in consultation with executives. While specifics vary, an effective EISP generally includes an overview of the corporate security philosophy, information on the security organization's structure, and clearly defined security responsibilities for all roles.

    Copyright:

    © All Rights Reserved

    Enterprise Information Security Policy

    Uploaded by

    LiRose Smith
    178 views1 page
    An enterprise information security policy (EISP) sets the strategic direction for an organization's security efforts by assigning responsibilities to various areas of information security and guiding the development of security programs. The EISP directly supports the organization's vision and mission statements and is drafted by the chief information security officer in consultation with executives. While specifics vary, an effective EISP generally includes an overview of the corporate security philosophy, information on the security organization's structure, and clearly defined security responsibilities for all roles.

    Copyright

    © © All Rights Reserved

    Did you find this document useful?

    Is this content inappropriate?

    An enterprise information security policy (EISP) sets the strategic direction for an organization's security efforts by assigning responsibilities to various areas of information security and guiding the development of security programs. The EISP directly supports the organization's vision and mission statements and is drafted by the chief information security officer in consultation with executives. While specifics vary, an effective EISP generally includes an overview of the corporate security philosophy, information on the security organization's structure, and clearly defined security responsibilities for all roles.

    Copyright:

    © All Rights Reserved
    178 views1 page

    Enterprise Information Security Policy

    Uploaded by

    LiRose Smith
    An enterprise information security policy (EISP) sets the strategic direction for an organization's security efforts by assigning responsibilities to various areas of information security and guiding the development of security programs. The EISP directly supports the organization's vision and mission statements and is drafted by the chief information security officer in consultation with executives. While specifics vary, an effective EISP generally includes an overview of the corporate security philosophy, information on the security organization's structure, and clearly defined security responsibilities for all roles.

    Copyright:

    © All Rights Reserved
    You are on page 1of 1

    Enterprise Information Security Policy

    An enterprise information security policy (EISP)—also known as a “security program policy,”


    “general security policy,” “IT security policy,” “high-level InfoSec policy,” or simply “InfoSec
    policy”—sets the strategic direction, scope, and tone for all of an organization’s security
    efforts. It assigns responsibilities for the various areas of InfoSec, including maintenance of
    InfoSec policies and the practices and responsibilities of end users. In particular, the EISP
    guides the development, implementation, and management requirements of the InfoSec
    program, which must be met by InfoSec management, IT development, IT operations, and
    other specific security functions.

    The EISP must directly support the organization’s vision and mission statements. It must
    also be defensible if legal challenges arise. It is an executive-level document, drafted by the
    chief information security officer (CISO) in consultation with the chief information officer
    (CIO) and other executives. Usually 2–10 pages long, it shapes the security philosophy in
    the IT environment. The EISP does not typically require frequent or routine modification
    unless the strategic direction of the organization changes.

    EISP Elements

    Although the specifics of EISPs vary from organization to organization, EISP documents
    should include the following elements:

     An overview of the corporate philosophy on security


     Information on the structure of the InfoSec organization and individuals who fulfill the
    InfoSec role
     Fully articulated responsibilities for security that are shared by all members of the
    organization (employees, contractors, consultants, partners, and visitors)
     Fully articulated responsibilities for security that are unique to each role within the
    organization

    You might also like