High-Level or Issue-Specific Policy?

About this interactive

Policies are the governing principles of a security program: the blueprint of what the organization is aiming for. The lesson sorts them into two levels. High-level policies set the overall tone for how the security program operates. Each one governs a whole area of the program across the organization: business continuity, disaster recovery, incident response, the software development life cycle (SDLC), risk management, access control and change management. Together they are wrapped up into the information security policy. Issue-specific and system-specific policies work more in the weeds. Each one sets the rules for a single issue, such as email, social media, passwords, working from home or acceptable use of company equipment, or for a single system, such as the payroll system or the CRM. These are often the policies users are asked to sign, and to sign again when they change. To sort a card, ask how wide the policy reaches: does it set how a whole part of the security program runs, or the rules for one issue or one system?

What you'll learn

Tell a high-level security policy, which sets how a whole area of the security program operates, from an issue-specific or system-specific policy, which sets the rules for one issue or one system

Aligned to

CompTIA Security+

5.1 Summarize elements of effective security governance.

ISC2 CISSP

1.6 Develop, document, and implement security policy, standards, procedures, and guidelines

Key terms

High-Level Security Policy: A broad organizational policy that establishes the overall goals and direction of a security program, serving as its foundational blueprint.
Issue-Specific Policy: A policy that addresses a particular security concern or system, such as email use, password requirements, or social media conduct.
Security Policy: A formal document that defines an organization's security goals, rules, and responsibilities.
Acceptable Use Policy: A documented policy that defines the rules and expectations for how employees and internal users may use organizational systems and resources. An AUP establishes the grounds for disciplinary or legal action if violated.

Topics

Security Policy Governance Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →