What is a Security Policy?
Security policy, told as a story about a castle where everyone did it their own way — until the king wrote a rule scroll.
Everyone in the castle does it differently. Some lock up, some don't.Some leave papers on the desk; some lend out keys. Everyone says that's just how he does it.
Thieves pick the loosest door. The new one doesn't know whom to follow.Nine locked doors don't help. With nothing decided, the castle is only as safe as its loosest person. Even the thief class needs rules to teach.
A security policy is the rule scroll the king wrote — what, how, and exceptions only by seal.The what is the policy — every door stays locked. The how is the standard and procedure — an iron lock, every time you leave. Exceptions only with the king's seal.
The scroll has to be read and practiced. Exceptions only by the king's seal.An unread scroll is just paper — so it gets read together in the thief class. Even "just today" goes on paper, so later everyone knows why the door was open.
Now whoever comes gets the same answer — the inspector, and the new one.With rules written down, you can keep them — and measure that you did. The inspector reads the scroll first. Who holds which key is the key ring's job.
Security policy = the rule scroll the king wrote and sealed. What (policy) → how (standard, procedure) → exceptions by seal. Read and practiced, or it's just paper.
A leadership-approved document stating what must be protected and how. Standards (specific requirements) and procedures (step-by-step) sit beneath it; exceptions are approved and recorded. It only works when reviewed regularly and taught.
When grown-ups say it
- Policy
- The what. Every door stays locked. One line the king wrote and sealed. Rarely changes.
- Standard / Procedure / Guideline
- The how. Standard: an iron lock. Procedure: when you leave, 1) close 2) lock 3) key to the guard room. Guideline: here's a good way.
- Acceptable Use Policy (AUP)
- What you may do in the castle. What the castle's tools may and may not be used for. The first scroll a newcomer reads.
- Exception approval
- The king's seal. Just today gets written down and sealed — with an end date.
- Policy review cycle
- Rereading every year. When the castle changes, the scroll must too. Usually once a year.
- Security awareness training
- The class that reads the scroll. An unread scroll is paper. → the thief class for everyone
- Compliance
- The inspector reads the scroll. Whether our scroll matches the neighbors' rules. → the inspector from next door
- Least privilege
- Only the keys you need. A staple rule on every scroll — keys only as far as the job needs. → a key ring for every hat