An information security policy is a document approved by senior management that establishes the company's guidelines for protecting information: what is required, what is prohibited, who is responsible for what, and what happens in the event of noncompliance. It is the foundation on which all other security rules rest.
Almost every company has a policy, but few have one employees know. The reason is usually a lengthy document in legal language, written for an audit and stored in an intranet folder.
Policy, standards, and procedures
An effective structure has three levels. The policy answers what and why, is approved by senior management, and changes infrequently. Standards provide the rules for each topic, are approved by the committee or responsible department, and change when the topic changes. Procedures describe how to do things step by step and follow the process of the team carrying them out.
The policy should also not be confused with the master plan. The policy defines how people should act; the information security master plan defines where the company will invest.
What the policy must contain
The core topics are:
- Objective and scope: who it applies to, including third parties and service providers.
- Roles and responsibilities: senior management, security, managers, employees, and third parties.
- Information classification: public, internal, confidential, and restricted, with the requirements for each level.
- Access control: least privilege and periodic review.
- Acceptable use: equipment, email, internet, personal devices, and AI tools.
- Incidents: how to report, to whom, and within what timeframe.
- Continuity and third parties: the existence of tested plans and requirements for suppliers with data or system access.
- Personal data protection: the link to the LGPD compliance program.
- Sanctions and review: consequences of noncompliance, review frequency, and review owner.
For institutions authorized by Brazil's Central Bank, cybersecurity policies now have more detailed minimum requirements, as explained in the article on BCB Resolution 538.
How to write an applicable policy
The policy fits into a few pages, with details covered in supporting standards. Its language should suit the people who must follow it. Management approval provides the authority to enforce compliance and apply sanctions, and communication must continue after the acknowledgment signed at hiring.
The policy also needs to keep pace with operations. A document from 2019 probably does not address large-scale remote work or generative AI. And rules written without input from those operating the systems tend to become permanent exceptions.
In regulated sectors, the policy is a formal requirement. In the electricity sector, the ANEEL Normative Resolution No. 964/2021 requires entities to maintain a cybersecurity policy approved by the board of directors, with a designated owner and periodic reviews.
Fictional example: the rule that did not exist
A legal services firm has a policy approved in 2019. A lawyer pastes a draft client contract into a public AI assistant to review the wording. Months later, the firm discovers no rule was broken: the policy does not mention AI tools, and the acceptable use standard covers only email and the internet.
Remediation includes a dedicated AI use standard defining approved tools and the data they may process, as discussed in the article on generative AI security, and an annual review cycle.
Processes and policies at Vultus
Vultus reviews the full set of processes and policies, with a concise top-level policy, topic-specific standards in clear language, and a review cycle aligned with operational and regulatory changes. Explore Vultus security processes and policies and read about third-party risk management.
