CompTIA Security+

Security Policy
• A security policy should describe how a company
addresses security issues

• Though local security policies may vary between

organizations, there are questions all organizations
should ask:

1. What assets require protection?

2. What are the possible threats?
3. What should be done in the event of a security
breach?
https://www.sans.org/information-security-policy
 Security Policy
• A security policy should describe how a company
addresses security issues

• Though local security policies may vary between

organizations, there are questions all organizations
should ask:

1. What assets require protection?

2. What are the possible threats?
3. What should be done in the event of a security
breach?
 Security Policy
• Security policies should be reviewed regularly and
updated as necessary.

• You should keep a revision history to track all policy

changes.

• Security is the responsibility of every person within

the company. All employees, including non-
computer users, must be trained to understand the
security policy and notified of any security policy
updates.
 Top Management
• CEO (Chief Executive Officer).

• CIO (Chief Information Officer).

• CTO (Chief Technology Officer) (Chief Technical Officer)

• CSO (Chief Security Officer).

• CISO (Chief Information Security Officer).

• CFO (Chief Financial Officer)

https://www.sans.org/information-security-policy
Finished