Issue Date: 2021

Network Security Policy for ABC Company

Purpose: To protect the confidentiality, integrity, and availability of company data

and systems by establishing and maintaining a secure network environment.

Scope: This policy applies to all employees, contractors, and third-party service
providers who have access to the company's network and systems.

1. Access Control: Access to the network and systems is restricted to authorized

personnel only. Passwords must be strong and changed regularly.
 Password length should be a minimum of 8 characters.
 Password complexity should be enabled
 Passwords should
2. Network Configuration: The network must be configured to prevent
unauthorized access and limit exposure to potential security threats. I.e
 Never use vendor default configurations
 Strong encryptions should be used on network devices.
 Network should be segmented.
 Redundancy should be implemented for network links.
 Prohibit the use of insecure protocols.
 Only devices that enjoy vendor support should be used on production.

3. Software Management: All software used on the network must be regularly

updated to address security vulnerabilities and to ensure compatibility with
other systems. For instance
 Smartnet should be in place for all network devices.

4. Incident Response: A plan for responding to security incidents must be in

place, including procedures for reporting and investigating incidents, and for
preserving evidence.
5. Training and Awareness: Regular training and awareness activities must be
conducted to ensure that all personnel are aware of the importance of
network security and their role in maintaining it.
6. Monitoring and Auditing: The network must be monitored for security
events, and regular audits must be performed to ensure compliance with this
policy.
 Logs should enabled.
 Logs should be archived on an external and centralized server.
 Devices should point to an NTP server.
7. Policy Review: This policy must be reviewed annually and updated to reflect
changes in technology, threats, and company practices.

Approved by Senior Management