Creating a Security Policy: Defining Acceptable and Unacceptable Activities

A strong security policy defines what is permitted and what is prohibited across your organization’s information systems. This policy acts as a blueprint for your operational security architecture, ensuring consistent protection at all system levels according to data classification and business needs.

A well-structured policy identifies who can perform specific actions on which resources. The table below illustrates an example of acceptable activities for a corporate website:

Acceptable activities may vary across organizations. For instance, internal (intranet) systems may permit broader access than public (internet) systems. When drafting or reviewing your organization’s policies, consult reputable cybersecurity resources such as SC Media for current best practices and case studies.

Clearly listing prohibited actions is essential for effective enforcement. These should be reviewed and updated regularly to reflect changes in technology and threat landscapes. Defining unacceptable behavior helps ensure that system protections, user education, and monitoring tools address specific organizational risks.

A complete security policy should include:

1. Inventory of hardware, software, and related security requirements
2. Physical and environmental protection measures
3. Procedures for handling system failures and incident recovery
4. Steps for reporting and responding to security breaches
5. Defined roles and responsibilities for users and administrators
6. Audit and compliance requirements
7. Ownership and accountability for protecting each resource

To ensure consistency, implement your security policy using the following steps:

1. Classify and document all organizational resources
2. Publish and communicate the policy organization-wide
3. Apply appropriate security controls to each resource
4. Log, test, and validate all systems periodically
5. Review and update your policy as technologies evolve

When drafting your policy, include clear information about:

1. Who is authorized to use the system and under what conditions
2. Access control procedures and revocation processes
3. Guidelines for remote and privileged access
4. Training requirements for users, administrators, and executives
5. Acceptable use of corporate assets and network resources
6. Incident response protocols and reporting structure
7. Baseline server configuration and maintenance requirements

Technology acquisition and deployment should align with your policy’s protection objectives. A well-governed acquisition framework includes:

1. A clearly documented organizational security policy
2. Information assurance architecture and standards
3. Guiding principles for secure system design
4. Procurement criteria emphasizing validated, trusted components
5. Configuration and hardening recommendations
6. Vendor risk assessment and continuous evaluation

Creating a comprehensive, adaptable security policy is the foundation of an effective cybersecurity strategy. By establishing clear permissions, defining boundaries, and maintaining accountability, organizations can minimize risk and build a resilient security posture.