Policy Information Policy Name: __________________________ ID: ______________ Type: ☐ Internet, ☐ Networks, ☐ Systems, ☐ Information Company/Agency/Organization: ___________________________________ Date: _____________ Team Name: _______________________________ Project Lead: ___________________________ Chief Executive Officer (CEO): ______________________ Role(s): Define your role(s) for this policy Chief Info Security Officer (CISO): ___________________ Role(s): Define your role(s) for this policy Senior Security Engineer (SSE): _____________________ Role(s): Define your role(s) for this policy Policy Details: 1. Statement of policy 2. Authorized Access and usage equipment 3. Prohibited use of equipment 4. Systems management 5. Violations of policy 6. Policy review and modification 7. Limitations of liability Table 4-2Components of an ISSP11 (Source: Whitman, Townsend, and Aalberts, Communications of the ACM) Components of an ISSP 1.Statement of policy a.Scope and applicability b.Definition of technology addressed c.Responsibilities 2.Authorized access and usage of equipment a.User access b.Fair and responsible use c.Protection of privacy 3.Prohibited use of equipment a.Disruptive use or misuse b.Criminal use c.Offensive or harassing materials d.Copyrighted, licensed, or other intellectual property e.Other restrictions 4.Systems management a.Management of stored materials b.Employee monitoring c.Virus protection d.Physical security e.Encryption 5.Violations of policy a.Procedures for reporting violations b.Penalties for violations 6.Policy review and modification a.Scheduled review of policy procedures for modification b.Legal disclaimers 7.Limitations of liability a.Statements of liability b.Other disclaimers as needed Figure 1 Shperes of Security Table 4-4ISO 27000 Series Current and Planned Standards17 ISO 27000 Series Standard Title or Topic Comment 27000 Series Overview and Terminology Defines terminology and vocabulary for the standard series 27001:2013 Information Security Management System Specification Drawn from BS7799:2 27002:2013 Code of Practice for Information Security Management Renamed from ISO/IEC 17799; drawn from BS7799:1 27003:2010 Information Security Management Systems Implementation Guidelines Guidelines for project planning requirements for implementing an ISMS 27004:2009 Information Security Measurements and Metrics Performance measures and metrics for information security management decisions 27005:2011 ISMS Risk Management Supports 27001, but doesn't recommend any specific risk method 27006:2011 Requirements for Bodies Providing Audit and Certification of an ISMS Largely intended to support the accreditation of certification bodies providing ISMS certification 27007:2011 Guideline for ISMS Auditing Focuses on management systems 27008:2011 Guideline for Information Security Auditing Focuses on security controls 27009:Draft Sector-specific application of ISO/IEC 27001 Guidance for th ...

1. Policy Information
Policy Name: __________________________ ID:
______________ Type: ☐ Internet, ☐ Networks, ☐ Systems, ☐
Information
Company/Agency/Organization:
___________________________________ Date:
_____________
Team Name: _______________________________ Project
Lead: ___________________________
Chief Executive Officer (CEO): ______________________
Role(s): Define your role(s) for this policy
Chief Info Security Officer (CISO): ___________________
Role(s): Define your role(s) for this policy
Senior Security Engineer (SSE): _____________________
Role(s): Define your role(s) for this policy
Policy Details:
1. Statement of policy
2. Authorized Access and usage equipment
3. Prohibited use of equipment
4. Systems management

2. 5. Violations of policy
6. Policy review and modification
7. Limitations of liability
Table 4-2Components of an ISSP11 (Source: Whitman,
Townsend, and Aalberts, Communications of the ACM)
Components of an ISSP
1.Statement of policy
a.Scope and applicability
b.Definition of technology addressed
c.Responsibilities
2.Authorized access and usage of equipment
a.User access
b.Fair and responsible use
c.Protection of privacy
3.Prohibited use of equipment
a.Disruptive use or misuse
b.Criminal use
c.Offensive or harassing materials
d.Copyrighted, licensed, or other intellectual property
e.Other restrictions
4.Systems management
a.Management of stored materials
b.Employee monitoring
c.Virus protection
d.Physical security
e.Encryption
5.Violations of policy

3. a.Procedures for reporting violations
b.Penalties for violations
6.Policy review and modification
a.Scheduled review of policy procedures for modification
b.Legal disclaimers
7.Limitations of liability
a.Statements of liability
b.Other disclaimers as needed
Figure 1 Shperes of Security
Table 4-4ISO 27000 Series Current and Planned Standards17
ISO 27000 Series Standard
Title or Topic
Comment
27000
Series Overview and Terminology
Defines terminology and vocabulary for the standard series
27001:2013
Information Security Management System Specification
Drawn from BS7799:2
27002:2013
Code of Practice for Information Security Management
Renamed from ISO/IEC 17799; drawn from BS7799:1
27003:2010
Information Security Management Systems Implementation
Guidelines
Guidelines for project planning requirements for implementing
an ISMS
27004:2009
Information Security Measurements and Metrics
Performance measures and metrics for information security
management decisions
27005:2011
ISMS Risk Management

4. Supports 27001, but doesn't recommend any specific risk
method
27006:2011
Requirements for Bodies Providing Audit and Certification of
an ISMS
Largely intended to support the accreditation of certification
bodies providing ISMS certification
27007:2011
Guideline for ISMS Auditing
Focuses on management systems
27008:2011
Guideline for Information Security Auditing
Focuses on security controls
27009:Draft
Sector-specific application of ISO/IEC 27001
Guidance for those who develop “sector-specific” standards
based on or relating to ISO/IEC 27001
27010:2015
Information security management for inter-sector and inter-
organizational communications
Guidance for inter-sector and inter-organizational
communications
27011:2008
Information security management guidelines for
telecommunications organizations
Guidance in the application of ISO/IEC 27002 in
telecommunications organizations
27013:2015
Guidance on the integrated implementation of ISO/IEC 27001
and ISO/IEC 20000-1
Support for implementing an integrated dual management
system
27014:2013
Governance of information security
ISO's approach to security governance—guidance on evaluating,
directing, monitoring, and communicating information security

5. 27015:2012
Information Security Management Guidelines for Financial
Services
Guidance for financial services organizations
27016:2014
Information security management — Organizational economics
Guidance for understanding the economical consequences of
information protection decisions
27017:2015
Code of practice for information security controls based on
ISO/IEC 27002 for cloud services
Guidance for practice in applying 27002 standards to cloud
services
27018:2014
Code of practice for protection of personally identifiable
information (PII) in public clouds acting as PII processors
Guidance for practice in applying 27002 standards to PII
processed in cloud services
27019:2013
Information security management guidelines for process control
systems specific to the energy industry
Focused on helping organizations in the energy industry
implement ISO standards
27023:2015
Mapping the revised editions of ISO/IEC 27001 and ISO/IEC
27002
Guidance on the revised editions of ISO/IEC 27001 and
ISO/IEC 27002
27031:2011
Guidelines for information and communication technology
readiness for business continuity
Application of ISO/IEC 27002 to information and
communication technology readiness for business continuity
27032:2012
Guidelines for cybersecurity
Guidance to achieve cybersecurity

6. 27033-1:2015
Network security — Part 1: Overview and concepts
Overview and concepts of network security
27033-2:2012
Network security — Part 2: Design and implementation of
network security
Guidance for the design and implementation of network security
27033-3:2010
Network security — Part 3: Reference networking scenarios —
Threats, design techniques, and control issues
Networking scenarios
27033-4:2014
Network security — Part 4: Securing communications between
networks using security gateways
Securing communications between networks using security
gateways
27033-5:2013
Network security — Part 5: Securing communications across
networks using virtual private networks (VPNs)
Securing communications across networks using VPNs
27034-1:2011
Application security — Part 1: Overview and concepts
Overview and concepts of application security
27034-2:2015
Application security — Part 2: Organization normative
framework for application security
A framework for application security
27035:2011
Information security incident management
Guidance for information security incident management
27036-1:2014
Information security for supplier relationships — Part 1:
Overview and concepts
Overview of information security for supplier relationships
27036-2:2014
Information security for supplier relationships — Part 2:

7. Requirements
Requirements for information security for supplier relationships
27036-3:2013
Information security for supplier relationships — Part 3:
Guidelines for information and communication technology
supply chain security
Guidelines for information security for supplier relationships
27038:2014
Specification for digital redaction
Digital redaction specification
27039:2015
Selection, deployment, and operations of intrusion detection
systems (IDPSs)
Guidance for IDPS selection, deployment, and operations
27040:2015
Storage security
Guidance on storage security
27041:2015
Guidance on assuring suitability and adequacy of incident
investigative methods
Guidance on incident investigative methods
27042:2015
Guidelines for the analysis and interpretation of digital
evidence
Guidelines for the analysis and interpretation of digital
evidence
27043:2015
Incident investigation principles and processes
Incident investigation principles and processes
27799:2008
Health informatics-Information security management in health
using ISO/IEC 27002
Provides guidance to health organizations and other holders of
personal health information on how to protect such information
via implementation of ISO/IEC 27002
Identified Future 27000 Series Standards (In Draft)

8. 27033-6
Network security — Part 6: Securing wireless IP network access
27034-3
Application security — Part 3: Application security
management process
27034-5
Application security — Part 5: Protocols and application
security controls data structure — XML schemas
27034-7
Application security — Part 7: Application security assurance
prediction
27035-2
Information security incident management — Part 2: Guidelines
to plan and prepare for incident response
27035-3
Information security incident management — Part 3: Guidelines
for CSIRT operations
Page 2 of 2