Building Information Security Policies With Ease

At NSF we like to think of security policies and a security framework just like we think of preventative care for our health. A security framework is essential to help ensure an organization has procedures and policies in place in the event of an incident or cyber-attack.

The exact components of a policy can vary based on the policy type, its complexity, and the specific focus of the policy. Typically though, they include a purpose; why the policy has been developed and who it applies to, the scope; where and how the policy will be applied, policy statement, and roles and responsibilities; who will be responsible for implementing and overseeing the policy.

The policy should also include definitions, procedures, exceptions, compliance measures, review and revision history, reference to any related documents, and the approval date.

Most of us understand that having a strong, secure password is essential. However, 80% of breaches today are due to poor passwords.¹ And cyber-attacks happen every 39 seconds.²

Haley reminds us, “Employees are your first line of defense. Creating a security-aware culture and deploying effective training for your employees helps prepare your organization for the steps it needs to take in the event of a cyber-attack”.

When sharing policies and training your employees, here are some suggestions from our expert team to help engagement and retention.

• Explain the ‘why’ - set out why security policy is so important, and the crucial role they play.
• Provide training that includes simulations or real-life scenarios - keep employees engaged; make it relatable, fun and relevant. Remember security training doesn’t have to be highly technical. It could be as simple as strong passwords.
• Share easily digestible materials.
• Regularly provide updates and refreshers.
• Encourage feedback and questions.

NSF has recently launched an internal phishing contest for its employees to keep security top of mind. The challenge is for employees to report the most phishing emails, and the winner gets a prize. This is just one example of how we are fostering a security-aware culture with our own teams.

NSF CyberSecure is a self-paced policy builder that enables organizations to build a security framework that encompasses Information security best practices, which can be customized to their needs.

Using AI capabilities NSF CyberSecure provides a mechanism for creating policies in areas such as access control, personal security, training, and physical security. It also serves as a repository for your organization’s polices which you can update and improve over time using robust version control. You can generate, customize and escalate policies for approval to your management team, all within the tool.

The package also includes access to information security training materials, which you can easily roll out to employees in your organization.

NSF CyberSecure is offered at $1500 per year via subscription. Each user subscription comes with three licences, providing a cost-effective solution. What’s more, you don’t have to be a technical specialist to use the intuitive platform. And your data is stored confidentially in an AWS cloud-governed environment.

The tool provides a great starting point for organizations who need to demonstrate their cybersecurity posture, for example to meet customer contractual requirements.

NSF is offering a free 14-day trial with access to one policy example so you can see for yourself how efficient and user-friendly the platform is.

Haley and Megan Turner, Audit Manager at NSF, leave us with these key takeaways on security policies:

• Security policies are fundamental for all organizations, big and small, for risk management, compliance, and fostering trust with your stakeholders and customers.
• Customize policies to meet your organization’s needs and review them regularly.
• Training is paramount. Ensure your team understands and adheres to the policies.

Haley concludes, “We want to think about information security just like we think about preventative care”.

Please note that any suggestions made in this article do not constitute consulting and following any of these suggestions is not linked in any way to the granting of certification.

¹www.securityescape.com/cybersecurity-spending-statistics/

²www.securityescape.com/password-reuse-statistics/