Producing Your Network Security Policy

Summary
Network security experts agree that well-run corporations need a written security policy. The policy sets appropriate expectations regarding the use and administration of corporate IT assets.

Process before writing Policy Creation

The Process
The first step in writing your policies is to gather a team. Writing a set of security policies is usually a top-down process, but it does not have to be, and may combine bottom-up and top-down approaches. Your policy development team should be made up of people who work with your network and the Internet, but come from different functional areas of the company. Each manager in your company has a unique view of the company's needs and risks. You need people who know something about the technology, but also some who know about business.

The Root Security Policy

The Root Security Policy
The first document you’ll draft is the “Root Security Policy.” This is also the easiest to write, as it is the framework which points to the other policy documents.
As you draft a Root Security Policy, you will also enumerate the initial list of subordinate policies that you should produce next.