Organisations define policies as **formal statements about organisational intent**. In short, they *explain why an organisation wishes to operate in a certain way*, and they define things like the purpose or objective of an activity or program. Incident response policies are commonly defined as part of building an IR capability. Well-written incident response policies will include important components of the IR process. They will *identify the team and the authority that the team operates under*. They will also require the *creation and maintenance of incident handling and response procedures and practices*, and they may define the overall IR process used by the organisation. In some cases, they may also have specific communication or compliance requirements that are included in the overall policy based on organisational needs. >[!Note] >It helps to bear in mind that a **policy** is a *high-level statement of management intent* that is used to convey the organisation's expectations and direction for a topic. **Standards** will then point to a policy for their authority, while *providing specific guidance about what should be done*. **Procedures** are then used to *implement standards or to guide how a task is done*. > >Policies tend to be slow to change, whereas standards change more frequently, and procedures and guidelines may be updated frequently to handle organisational needs or technology change, or for other business-related reasons. An **information security policy** will generally contain broad statements about cybersecurity objectives, including the following: - A statement of the importance of cybersecurity to the organisation - Requirements that all staff and contractors take measures to protect the confidentiality, integrity, and availability of information and information systems - Statement on the ownership of information created and/or possessed by the organisation - Designation of the CISO or other individual as the executive responsible for cybersecurity issues - Delegation of authority granting the CISO the ability to create standards, procedures, and guidelines that implement the policy Organisations commonly include the following documents in their information security policy library: - *Information security policy* that provides high-level authority and guidance for the security program - *Incident response policy* that describes how the organisation will respond to security incidents - *Acceptable use policy* (AUP) that provides network and system users with clear direction on permissible uses of information resources - *Business continuity and disaster recovery policies* that outline the procedures and strategies to ensure that essential business functions continue to operate during and after a disaster, and that data and assets are recovered and protected - *Software development life cycle (SDLC) policy* that establishes the processes and standards for developing and maintaining software, ensuring that security is considered and integrated at every stage of development - *[[Change Management]] and change control policies* that describe how the organisation will review, approve, and implement proposed changes to information systems in a manner that manages both cybersecurity and operational risk