Recently, we went through a complete security review and tightened our security policies.
There are a few key areas needed for a comprehensive security policy.
1. Technology Use Policy. This is a policy that directs and governs the use of technology in the company for the general user. This explains the company's position on use of passwords, use of PC's, licensing procedures, proper e-mail use, proper internet use. Every computer user should read and sign this policy before having access to any computer equipment or system.
2. Internal IT Security policy. This is a policy that directs and governs the deployment of technology by the IT staff. This includes issues like control of administrative passwords, virus management, physical security of computer equipment, how user access is approved and granted, system backups and media retention, asset inventory management, what happens when an employee leaves, disaster recovery procedure, etc.
3. Audit procedure. This is the procedure which documents the method and frequency of verification of the security policy. If you have many locations operating under these guidelines, a periodic audit should take place to confirm that procedures are understood and being followed. This audit should include all of the elements of the above policies.
There are some good sources for reference on this website.
Good luck with your project. It takes some hard work to get all procedures documented and in place.
