Implementing Security Policy

I think your first step should be to HR department. Because many things are designed and documented and collect dust in HR closets. It may be related to physical IT security, Internet/email/network access, disk space, software installation, etc. Another point - you may implement something by your initiative, what goes against company policy and it may be trouble for you.

But you can implement some "technical" security policies like password policy, directory and resources access, remote access, "screensaver" policy, antivirus software, etc. It's very big field but you better to negotiate everything with executive staff.

Good luck,

Mike

I'd say you are going to have a lot of work ahead of you!

In addition to going to the HR departement for info, I'd draw up a guidline for the IS Policy and march up to management with this in hand. Have them commit to doing it right from the beginning. Second get a book on IS, that might help you in your task. But mainly get commitment from your management and also resources to do the job.

Oh and yes, you are going to need a lot of time to complete this task. It is an neverending project.But start with the passwordpolicy, Virusscanners and firewalls. Dont forget backups or UPS:s. I'm working on my masters thesis with this so do your background checking with care, and everything will hopefully be OK!

Good Luck

If you don't have anything in writing, then you have a project set for failure. It certainly doesn't do any good for you to try to set security to enforce a policy that can't be backed up in writing.

I wouldn't even take on this assignment. Push back, until you get detailed written security specifications and a written security policy. If you have to come up with those yourself, make sure that it becomes official policy before you do anything, or you'll just be a security zealot trying to enforce something spoken that won't have any ground to stand upon when things get sticky.
That's my 2 cents anyway.