Policy Writing in Practice

Security policies record management direction, responsibilities, and requirements. Their value depends on whether the text is authorized, understandable, connected to implementable procedures and controls, communicated to the right audience, and maintained as the organization changes.