Cybersecurity · Intermediate level

Intermediate level · Module 5: Security Policies and Awareness · Lesson 1 of 3

Writing Practical Policies

Write short policies that tell people clearly what to do.

In this lesson you will

  • Structure a security policy
  • Write clear, enforceable rules

Key concepts

policy purpose and scopeclear rulesresponsibilitiesreview dates

The lesson

A policy states its purpose, who it applies to, the rules, responsibilities and what happens if it is not followed.

Write rules people can follow: 'Use the password manager for all work accounts and turn on MFA where available' rather than 'Ensure adequate authentication'.

Agree policies with management, explain them to staff and review them yearly.

Step by step

  1. Choose two policies to write.
  2. Draft purpose, scope and rules.
  3. Assign responsibilities.
  4. Have a non-technical person review them.

Practice activity

Write an acceptable use policy and a password and MFA policy.

Expected result: Two short, clear, enforceable policies.

Check your understanding

  1. Name four parts of a policy.

    Show answer

    Purpose, scope, rules and responsibilities.

  2. Why test a policy on a non-technical reader?

    Show answer

    To make sure everyone can understand and follow it.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.