Скачать или смотреть CISSP Domain 1 - Implementing Security Policy

A security policy defines the scope of security needed by the organization and discusses the assets that require protection and the extent to which security solutions should go to provide the necessary protection. It contains:
The main security objectives and security framework of an organization
The major functional areas of data processing and all relevant terminology definition
A strategic plan for implementing security outlining the security goals and practices that should be employed to protect the organization’s vital interests
The security policy is used to assign responsibilities, define roles, specify audit requirements, outline enforcement processes, indicate compliance requirements, and define acceptable risk levels.
This document is often used as the proof that senior management has exercised due care in protecting itself against intrusion, attack, and disaster
Security policies are compulsory