In last week's post, Exploring 3 Different Types of IT Documentation, we briefly touched on policies as one of the three common types of documentation. The importance of IT policies cannot be overstated. Policies are very important as they portray an organization's stance at a high level.
As a quick review, consider policies at a general level. Policies are high-level guidance applicable to all departments and divisions of an organization. They are essentially a documented way to communicate expected behavior and appropriate resource use.
It doesn't take much research to support the how and the why policies are important. Just from using an internet search engine alone you can find articles on the importance of policies published in the last 20 years or so. Despite the proliferation of the topic, the discussion is not even close to slowing down. There are many organizations who are simply behind in updating and creating proper information technology and security policies.
A quick example of the importance of written policies is as follows:
A manager calls a meeting and begins on a tirade about the lack of people wearing personal protective equipment. Two of the supervisors in the meeting had opposite takeaways of what the manager's rant meant. One supervisor knows it's just a rant and waits to see if there are any upcoming rule changes and the other supervisor swiftly and severely cracks down on their employees. To read more, view this PDF: Chapter 13: The Importance of Written Policies and Procedures at Michigan Municipal League. This message isn't about IT, but it's an interesting read, and I suggest you take a look at it.
Now, consider policies at the department level.
Once information technology and security policies are written and implemented, the way is paved for developing standard operating procedures, purchasing decisions, plans, forms, and other organizational tools and decisions. Additional documentation can be created from policies as needed to help measure specific objectives. Once a clear goal has been established, it is much easier to maintain control and overall quality of technology and information services.
This is especially helpful in achieving compliance with legal and other regulatory standards.
Additional Reading:
- The Basics of an IT Security Policy by Jack G. Albright.
- What Makes a Good Security Policy and Why is One Necessary? by Caroline Reyes.
- What's Your Policy? by M Edwards.
- How to Develop Good Security Policies by Kerry D. McConnell.
Do you agree on the importance of having policies?
