Data protection and security policies (Interview to Ignacio Íñigo)

Data protection implies that a company or government entity keeps safe any information that may be confidential. As we can see, today, the information we handle may be in the magnifying glass of some hacker or cyber persecutor.

In the case of companies, security policies must be handled with strict rigor, since information about customers is at stake, which could be violated.

In this sense, you will wonder how to make a security policy and who is involved, in addition to what comes along with a security policy and what steps must be followed.

What is a policy?

As Ignacio Íñigo explained in our previous article, “It defines the scope of security within an organization, the assets that must be protected and what level of protection is acceptable. They provide an overview of the security needs in an organization and define security objectives. It is the strategic plan. Define roles, assign responsibilities, audit and regulatory requirements, and acceptable risk levels. They are mandatory. They generally serve as proof that due care is being taken ”.

Likewise, it contemplates those steps that need to be taken to avoid the loss or theft of information within a company or government entity.

Consider greater security in your company information …

In addition to policies, when documenting the security posture in our organization, the following documents must also be created, as Ignacio details:

Standard: Mandatory requirements for hardware, software, and security controls. It is the way to document our tactical plan.

Baseline: It refers to the minimum level of security that every system in the organization must guarantee. It is a safe state on top of which other even more restrictive security controls can be implemented.

Guideline: Recommendations on how to implement standards and baselines. They are suggestions, methodologies, and recommendations, but it is not mandatory to use them, although normally if they are not followed, it is advisable to document why.

 Procedures: Documents, step by step how to implement a security mechanism or control. They assure you that by following them, you meet a certain standard or policy. They are usually system or product specific.

Having a plan reduces cyber risk…

A plan will be the best guide for compliance with the policies after they are defined. As mentioned in the previous article, it is recommended that they be duly reviewed, at least once a year, or even more frequently if there are significant changes along the way.

In this sense, these are the plans that a company takes when implementing  cybersecurity policy:

 Strategic Plan: Defines the organization’s security posture. It is aligned with its objectives and goals. It is normally reviewed annually and documented in the form of security policies.

Tactical Plan: It is a midterm plan, and it is more detailed at describing how to achieve the objectives defined in the strategic plan. Some examples: project plans, acquisition plans, hiring plans, systems development, and technical support plans.

Operational Plan: Refers to a plan to achieve a specific objective defined in the strategic and tactical plans. It includes planning, budgets, required personnel, step-by-step procedures, etc. Some examples would be training plans, deployment plans, or product design plans.

Similarly, Ignacio mentions that those involved in creating security policies are: “Typically the Director of Information Security (CISO) will lead the creation of the security policy or policies. To do this, they usually form a committee or working group in which there are representatives from various departments within the company (managers, human resources, finance, legal department, etc.) ”.

Each company manages its policies …

Although it seems that all companies or government entities must follow the same pattern, it is important to mention that it will depend on the heading or sector to which the company is dedicated. Also, the policies will be affected by the cybersecurity laws of each country, each one is aware of the level of protection that must be provided to the information that is handled.

Nowadays, it is necessary to avoid information leakage since it not only has consequences on a monetary level but also on a personal level. The data and information that is handled must be treated with the rigor it deserves. 

Do you want to know more? Stay tuned and follow the following articles #WeBlogIt