Administrative Controls - Documentation and Policies

Without good documentation and clarified policies, you don't really have a great cybersecurity structure in place. It's an important part of how we do business and making sure that we can carry out things in a secure way.

Reinventing the Process Every Year

I want you to imagine a little bit of a scenario. Let's say last year we went through some sort of process. Maybe it was an audit. We audited certain things last year and we need to do it again this year. And so now I sit down and I think, oh, what did we do last year? What were the things that we encountered that were an issue? What were the things that we did right? And then I try to implement that same thing.

Now, the thing is, I probably would do a little bit better than last year, but I might forget some of the lessons that we learned back then. I might forget exactly what process we used back then. So to a certain degree, I'm reinventing this whole audit process once again, and I'm going to have to continue to do that year after year. There might be minor improvements, but we're not going to get huge improvements until we start really documenting things.

Why? Because once I document something, I document the process, I go through the process, I realize these need to be corrected. So I document what went wrong and what went right. And then this year I take that what went wrong, what went right, and improve the process, make it better. So my starting point is wherever I left off last year, and I can improve it so much better when I document things.

Now take that same scenario and let's say somebody else is doing the audit and I don't have any documentation. They definitely will have to reinvent everything all over again. But if I have documentation that I have to pass off to them, now they're starting at the ending point that I did last year. They're starting from the same point that I ended last year, and they can take it from there and continue to improve it. So it just makes a lot of sense to document our processes and how we do things, because then we can get to this continuously improving those different tasks, those different processes.

What Documentation Does for Us

So what does documentation do for us? Well, when we document something, we can get more consistent in how we implement it. From there, also, we can look exactly at what we're doing and find errors and issues and correct those, so we can improve this process. It's just efficient because we don't have to reinvent things every time, so there's an efficiency that happens with this. Plus, other people can join in on the process when I have it documented. And the quality is going to continue to go up and up and up. So it just makes a lot of sense to continue to document things and continue to improve that document.

Policies as a Blueprint

Policies are kind of like documents, but they take it to the next level. They're governing principles. It allows us to create the structure that we understand what needs to happen, and this hierarchy, so that way when we implement things, we're actually implementing them towards a standard, towards what the company actually wants.

Think of this as like a blueprint. When we have a blueprint, we know what is expected and what we're supposed to be building towards. If we're building a house, we need a blueprint so we know what the end result is supposed to be. If we didn't have that blueprint, then we would be all lost and we couldn't have everybody coordinated together. We couldn't have the plumbers and electricians and the framers and the drywallers all coordinated on what's supposed to happen. And it could cause a lot of confusion.

By creating policies, it creates a direction and it creates a focus. It creates an end result that we're working towards. To a certain degree, policies give us a set of standards that we live up to. And it creates consistency, efficiency, and continuous improvement, just like any documentation would for us.

It also creates things so that they're more scalable, and we can use other people and other people can do the same thing as we do, because we have these documentations, we have these standards, we have these policies. It sets the expectations so we know who is responsible for what, and then it creates accountability. Since we know who is responsible for which parts, then there's an accountability piece and we can follow up and say, hey, why did this not get done?

Furthermore, these policies and procedures and everything that we create just might be required by law or regulations, or maybe some sort of vendor we're partnering with, maybe our customers. There are certain things that might just require us to put these policies, to put things into place that are going to create this secure structure for our organization.

The Backbone of a Security Program

There's a lot more to it than that. We'll get into things like policies, standards, procedures, guidelines, and controls, and what the differences are between all of these. But essentially we create this structure of policies, which guide our standards, which then guide our procedures, and may include some guidelines to help us along the way. So we'll get more into what these different meanings are, but just know that this is the backbone of the security program that we would implement as the foundation, and make sure everybody's on the same page and get us going towards a common goal.