This chapter is from the book
This chapter is from the book
This chapter is from the book
Summary
You now know that policies need supporting documents to give them context and meaningful application. Standards, guidelines, and procedures provide a means to communicate specific ways to implement our policies. We create our organizational standards, which specify the requirements for each policy. We offer guidelines to help people comply with standards. We create sets of instructions known as procedures to ensure that tasks are consistently performed. The format of a procedure—simple step, hierarchical, graphic, or flowchart—depends on the complexity of the task and the audience. In addition to creating policies, we create plans or programs to provide strategic and tactical instructions and guidance on how to execute an initiative or how to respond to a situation, within a certain time frame, usually with defined stages and with designated resources.
Writing policy documents is a multistep process. First, we need to define the audience for which the document is intended. Then, we choose the format. Options are to write each policy as a discrete document (singular policy) or to group like policies together (consolidated policy). Finally, we need to decide upon the structure, including the components to include and in what order.
The first and arguably most important section is the introduction. This is our opportunity to connect with the reader and to convey the meaning and importance of our policies. The introduction should be written by the “person in charge,” such as the CEO or president. This person should use the introduction to reinforce company-guiding principles and correlate them with the rules introduced in the security policy.
Specific to each policy are the heading, goals and objectives, policy statement, and (if applicable) exceptions. The heading identifies the policy by name and provides the reader with an overview of the policy topic or category. The goals and objectives convey what the policy is intended to accomplish. The policy statement lays out the rules that need to be followed and may reference the implementation instructions (standards) or corresponding programs. Policy exceptions are agreed waivers that are documented within the policy.
An exemption or waiver process is required for exceptions identified after a policy has been authorized. The policy enforcement clause is where the sanctions for willful non-adherence to the policy are unequivocally stated to reinforce the seriousness of compliance. Administrative notations refer the reader to additional information and/or provide references to internal resources. The policy definition section is a glossary of terms, abbreviations, and acronyms used in the document that the reader may be unfamiliar with.
Recognizing that the first impression of a document is based on its style and organization, we studied the work of the plain language movement. Using plain language helps produce documents that are easy to read, understand, and use. We looked at 10 techniques from the Federal Plain Language Guideline that we can (and should) use for writing effective policies. In the next section of the book, we put these newfound skills to use.