Information Security Policy
Drafts a formal Information Security Policy satisfying multi-framework regulatory requirements with enforceable operational guidance.
Prerequisites
- Org profile — industry sector, employee count, jurisdictions of operation
- Regulatory triggers — applicable frameworks (HIPAA, GDPR, CCPA, GLBA, FERPA, PCI DSS, SOC 2, ISO 27001, NIST CSF)
- Existing governance docs — current policies, data classification schemes, incident response plans
- Data inventory — sensitive data categories handled (PHI, PII, payment card data, student records, trade secrets)
- Approving authority — CEO, Board, CISO, General Counsel signature blocks needed
Output Structure
Document Control Block
| Field |
Content |
| Policy Title |
Information Security Policy |
| Version / Effective Date |
[#] / [Date] |
| Approved By / Owner |
[Title] / CISO or equivalent |
| Next Review |
[Date + 1 year] |
| Supersedes |
[Prior version or N/A] |
Section Outline
1. Purpose & Authority
- Business rationale (financial, reputational, regulatory risk)
- Authorizing resolution; relationship to other org policies
2. Scope
- Entities: parent, subsidiaries, affiliates, JVs
- Personnel: employees, contractors, vendors, partners
- Assets: electronic data, physical records, IP, BYOD, remote environments
- Exclusions: publicly available info, de-identified data (define standard)
3. Definitions
Define with legal precision; flag where definitions vary by jurisdiction:
- Confidential Information, Personal Data / PII (per GDPR Art. 4, CCPA § 1798.140, HIPAA 45 C.F.R. § 160.103)
- Data Breach, Security Incident, Data Owner, Data Custodian, Authorized User
- Classification Levels: Public / Internal / Confidential / Restricted
4. Data Classification
| Level |
Description |
Examples |
| Public |
Approved for external release |
Marketing materials |
| Internal |
Business use; not for external distribution |
Org charts, internal memos |
| Confidential |
Limited distribution; legal obligations |
Customer PII, financial data |
| Restricted |
Highest sensitivity; regulatory protection |
PHI, payment card data, credentials |
5. Access Controls
- Least privilege; separation of duties
- Lifecycle: request → data owner approval → provisioning → quarterly review → revocation on role change/termination
- Privileged access: separate admin accounts; logged and audited
6. Authentication
| Requirement |
Standard |
| Password length |
12+ characters; mixed case, numbers, symbols |
| MFA required for |
Remote access, privileged accounts, Restricted data, cloud admin |
| Acceptable MFA |
TOTP, hardware token, biometric; SMS discouraged for high-risk |
| Shared credentials |
Prohibited |
7. Encryption Standards
| Context |
Minimum Standard |
| Data at rest (Confidential/Restricted) |
AES-256 |
| Data in transit |
TLS 1.2+ (1.3 preferred) |
| Portable devices |
Full-disk encryption |
| Email (Restricted) |
End-to-end or secure portal |
| Backup media |
Encrypted; separate key management |
Review annually; superseded by org Security Standards if more stringent.
8. Acceptable Use
- Prohibited: illegal activity, harassment, circumventing controls, credential sharing
- Monitoring: org reserves right; no expectation of privacy on org systems
- BYOD: MDM enrollment, encryption, remote wipe on loss/termination
9. Physical Security
- Lock unattended devices; clean desk for Confidential/Restricted materials
- Secure disposal: cross-cut shredding (paper); cryptographic erasure or destruction (media)
- Visitor access: escorted in secure areas; logs maintained
10. Data Retention & Disposal
| Category |
Period |
Basis |
| PHI |
6 years |
HIPAA 45 C.F.R. § 164.530(j) |
| Financial records |
7 years |
IRS / GLBA |
| Student records |
Per FERPA |
34 C.F.R. § 99 |
| Incident logs |
3 years min |
[Regulatory basis] |
Certificate of destruction required for Restricted data.
11. Roles & Responsibilities
| Role |
Obligations |
| Board / Exec |
Policy approval; resource allocation |
| CISO |
Program ownership; standards; audit; regulator liaison |
| IT / Security |
Controls; patching; monitoring; vulnerability mgmt |
| Legal / Privacy |
Breach notification decisions; regulatory liaison |
| Managers |
Access approval; team compliance; off-boarding |
| All Employees |
Credential protection; incident reporting; training |
| DPO |
Required under GDPR Art. 37 if applicable |
12. Incident Response
Lifecycle:
- Detect & Report — within [1–4 hours] to security hotline
- Assess — severity triage; activate IRT if Sev 1/2
- Contain — isolate systems; preserve evidence; chain of custody
- Eradicate — remove threat; patch vulnerability
- Recover — restore from clean backups; verify integrity
- Post-Incident Review — within 14 days; root cause; corrective action plan
IRT: CISO (lead), IT Security, Legal, HR, PR/Comms, Executive Sponsor.
13. Breach Notification
| Framework |
Deadline |
Recipients |
| HIPAA |
60 days (individuals); 60 days HHS + media if 500+ |
Individuals, HHS, media |
| GDPR |
72 hours to SA; without undue delay to individuals if high risk |
SA, affected individuals |
| CCPA/CPRA |
Expedient / without unreasonable delay |
Consumers; AG if 500+ CA |
| State laws |
30–90 days (varies) |
Residents, AGs, credit bureaus |
| PCI DSS |
Immediately |
Card brands, acquiring bank |
Legal counsel notified immediately upon any incident involving personal data.
14. Third-Party & Vendor Management
- Security assessment before vendor access to Confidential/Restricted data
- Required contractual provisions: DPA / BAA as applicable
- Right-to-audit for Restricted data vendors
- Access revoked immediately on contract termination
15. Regulatory Compliance Matrix
| Framework |
Applicability |
Key Requirements |
| HIPAA (45 C.F.R. §§ 164.302–318) |
Healthcare / PHI |
Admin, physical, technical safeguards; BAAs |
| GLBA (16 C.F.R. § 314) |
Financial institutions |
Risk assessment; safeguards; service provider oversight |
| FERPA (34 C.F.R. § 99) |
Education |
Student record protection; disclosure restrictions |
| GDPR |
EU personal data |
Lawful basis; data subject rights; DPIAs; SCCs |
| CCPA/CPRA |
CA residents |
Consumer rights; opt-out; privacy notice |
| PCI DSS v4.0 |
Payment cards |
Detailed controls in separate PCI procedures |
| NIST CSF 2.0 |
Voluntary |
Identify, Protect, Detect, Respond, Recover, Govern |
| ISO 27001 |
Voluntary |
ISMS; Annex A controls |
16. Training & Awareness
- All personnel: at hire + annually; phishing simulation semi-annually
- High-risk roles (sysadmins, developers, finance): role-specific training annually
- Completion tracked; non-completion escalated; records retained 3 years
17. Compliance Monitoring & Audit
- Annual risk assessment; quarterly vulnerability scans; annual penetration test
- Access reviews: semi-annual (Confidential), quarterly (Restricted)
- Remediation SLAs — Critical: 30 days, High: 60 days, Medium: 90 days
18. Enforcement
Progressive discipline: retraining → written warning → suspension/termination → civil liability → criminal referral. Factors: intent, severity, prior violations, self-reporting.
19. Policy Administration
- Review: annually or upon major incident, regulatory change, material org change
- Approval: [CEO/Board] on CISO + General Counsel recommendation
- Employees acknowledge receipt in writing; at-will status unaffected
Signature Block
| Role |
Name |
Signature |
Date |
| CEO |
|
|
|
| CISO |
|
|
|
| General Counsel |
|
|
|
Employee Acknowledgment
I acknowledge receipt of, have read, and agree to comply with the Information Security Policy (Version [#], effective [Date]).
Name: ______ Title: ______ Date: ______ Signature: ______
Guidelines
- Multi-jurisdiction conflicts: apply most stringent standard or add jurisdiction-specific schedules
- Encryption floors: AES-256 / TLS 1.2+ are minimums; revise per NIST guidance updates
- GDPR DPO: required if org is public authority, conducts large-scale monitoring, or processes special category data at scale — confirm applicability before drafting
[VERIFY]
- HIPAA BAAs: policy cross-references but does not replace BAA; maintain separate vendor register
- PCI DSS: detailed technical controls in separate PCI documentation to allow updates without policy re-approval
- At-will disclaimer: verify enforceability under applicable state law
[VERIFY]
- Collective bargaining: if unionized workforce, confirm no bargaining obligation before implementation
- Do not fabricate citations — use
[VERIFY] for any citation not confirmed against primary source
1---2name: information-security-policy3description: Drafts a board-approvable Information Security Policy covering data classification, access controls, encryption, incident response, breach notification, and enforcement. Tailored by industry and regulatory environment (HIPAA, GDPR, CCPA, GLBA, FERPA, PCI DSS). Use when drafting or overhauling an organization's foundational information security governance framework or cybersecurity policy.4---5
6# Information Security Policy
7
8Drafts a formal Information Security Policy satisfying multi-framework regulatory requirements with enforceable operational guidance.
9
10## Prerequisites
11
121. **Org profile** — industry sector, employee count, jurisdictions of operation
132. **Regulatory triggers** — applicable frameworks (HIPAA, GDPR, CCPA, GLBA, FERPA, PCI DSS, SOC 2, ISO 27001, NIST CSF)
143. **Existing governance docs** — current policies, data classification schemes, incident response plans
154. **Data inventory** — sensitive data categories handled (PHI, PII, payment card data, student records, trade secrets)
165. **Approving authority** — CEO, Board, CISO, General Counsel signature blocks needed
17
18## Output Structure
19
20### Document Control Block
21
22| Field | Content |
23|-------|---------|
24| Policy Title | Information Security Policy |
25| Version / Effective Date | [#] / [Date] |
26| Approved By / Owner | [Title] / CISO or equivalent |
27| Next Review | [Date + 1 year] |
28| Supersedes | [Prior version or N/A] |
29
30### Section Outline
31
32**1. Purpose & Authority**
33- Business rationale (financial, reputational, regulatory risk)
34- Authorizing resolution; relationship to other org policies
35
36**2. Scope**
37- **Entities:** parent, subsidiaries, affiliates, JVs
38- **Personnel:** employees, contractors, vendors, partners
39- **Assets:** electronic data, physical records, IP, BYOD, remote environments
40- **Exclusions:** publicly available info, de-identified data (define standard)
41
42**3. Definitions**
43Define with legal precision; flag where definitions vary by jurisdiction:
44- Confidential Information, Personal Data / PII (per GDPR Art. 4, CCPA § 1798.140, HIPAA 45 C.F.R. § 160.103)
45- Data Breach, Security Incident, Data Owner, Data Custodian, Authorized User
46- Classification Levels: Public / Internal / Confidential / Restricted
47
48**4. Data Classification**
49
50| Level | Description | Examples |
51|-------|-------------|---------|
52| Public | Approved for external release | Marketing materials |
53| Internal | Business use; not for external distribution | Org charts, internal memos |
54| Confidential | Limited distribution; legal obligations | Customer PII, financial data |
55| Restricted | Highest sensitivity; regulatory protection | PHI, payment card data, credentials |
56
57**5. Access Controls**
58- Least privilege; separation of duties
59- Lifecycle: request → data owner approval → provisioning → quarterly review → revocation on role change/termination
60- Privileged access: separate admin accounts; logged and audited
61
62**6. Authentication**
63
64| Requirement | Standard |
65|-------------|---------|
66| Password length | 12+ characters; mixed case, numbers, symbols |
67| MFA required for | Remote access, privileged accounts, Restricted data, cloud admin |
68| Acceptable MFA | TOTP, hardware token, biometric; SMS discouraged for high-risk |
69| Shared credentials | Prohibited |
70
71**7. Encryption Standards**
72
73| Context | Minimum Standard |
74|---------|-----------------|
75| Data at rest (Confidential/Restricted) | AES-256 |
76| Data in transit | TLS 1.2+ (1.3 preferred) |
77| Portable devices | Full-disk encryption |
78| Email (Restricted) | End-to-end or secure portal |
79| Backup media | Encrypted; separate key management |
80
81Review annually; superseded by org Security Standards if more stringent.
82
83**8. Acceptable Use**
84- Prohibited: illegal activity, harassment, circumventing controls, credential sharing
85- Monitoring: org reserves right; no expectation of privacy on org systems
86- BYOD: MDM enrollment, encryption, remote wipe on loss/termination
87
88**9. Physical Security**
89- Lock unattended devices; clean desk for Confidential/Restricted materials
90- Secure disposal: cross-cut shredding (paper); cryptographic erasure or destruction (media)
91- Visitor access: escorted in secure areas; logs maintained
92
93**10. Data Retention & Disposal**
94
95| Category | Period | Basis |
96|----------|--------|-------|
97| PHI | 6 years | HIPAA 45 C.F.R. § 164.530(j) |
98| Financial records | 7 years | IRS / GLBA |
99| Student records | Per FERPA | 34 C.F.R. § 99 |
100| Incident logs | 3 years min | [Regulatory basis] |
101
102Certificate of destruction required for Restricted data.
103
104**11. Roles & Responsibilities**
105
106| Role | Obligations |
107|------|-------------|
108| Board / Exec | Policy approval; resource allocation |
109| CISO | Program ownership; standards; audit; regulator liaison |
110| IT / Security | Controls; patching; monitoring; vulnerability mgmt |
111| Legal / Privacy | Breach notification decisions; regulatory liaison |
112| Managers | Access approval; team compliance; off-boarding |
113| All Employees | Credential protection; incident reporting; training |
114| DPO | Required under GDPR Art. 37 if applicable |
115
116**12. Incident Response**
117
118Lifecycle:
1191. **Detect & Report** — within [1–4 hours] to security hotline
1202. **Assess** — severity triage; activate IRT if Sev 1/2
1213. **Contain** — isolate systems; preserve evidence; chain of custody
1224. **Eradicate** — remove threat; patch vulnerability
1235. **Recover** — restore from clean backups; verify integrity
1246. **Post-Incident Review** — within 14 days; root cause; corrective action plan
125
126IRT: CISO (lead), IT Security, Legal, HR, PR/Comms, Executive Sponsor.
127
128**13. Breach Notification**
129
130| Framework | Deadline | Recipients |
131|-----------|----------|-----------|
132| HIPAA | 60 days (individuals); 60 days HHS + media if 500+ | Individuals, HHS, media |
133| GDPR | 72 hours to SA; without undue delay to individuals if high risk | SA, affected individuals |
134| CCPA/CPRA | Expedient / without unreasonable delay | Consumers; AG if 500+ CA |
135| State laws | 30–90 days (varies) | Residents, AGs, credit bureaus |
136| PCI DSS | Immediately | Card brands, acquiring bank |
137
138Legal counsel notified immediately upon any incident involving personal data.
139
140**14. Third-Party & Vendor Management**
141- Security assessment before vendor access to Confidential/Restricted data
142- Required contractual provisions: DPA / BAA as applicable
143- Right-to-audit for Restricted data vendors
144- Access revoked immediately on contract termination
145
146**15. Regulatory Compliance Matrix**
147
148| Framework | Applicability | Key Requirements |
149|-----------|--------------|-----------------|
150| HIPAA (45 C.F.R. §§ 164.302–318) | Healthcare / PHI | Admin, physical, technical safeguards; BAAs |
151| GLBA (16 C.F.R. § 314) | Financial institutions | Risk assessment; safeguards; service provider oversight |
152| FERPA (34 C.F.R. § 99) | Education | Student record protection; disclosure restrictions |
153| GDPR | EU personal data | Lawful basis; data subject rights; DPIAs; SCCs |
154| CCPA/CPRA | CA residents | Consumer rights; opt-out; privacy notice |
155| PCI DSS v4.0 | Payment cards | Detailed controls in separate PCI procedures |
156| NIST CSF 2.0 | Voluntary | Identify, Protect, Detect, Respond, Recover, Govern |
157| ISO 27001 | Voluntary | ISMS; Annex A controls |
158
159**16. Training & Awareness**
160- All personnel: at hire + annually; phishing simulation semi-annually
161- High-risk roles (sysadmins, developers, finance): role-specific training annually
162- Completion tracked; non-completion escalated; records retained 3 years
163
164**17. Compliance Monitoring & Audit**
165- Annual risk assessment; quarterly vulnerability scans; annual penetration test
166- Access reviews: semi-annual (Confidential), quarterly (Restricted)
167- Remediation SLAs — Critical: 30 days, High: 60 days, Medium: 90 days
168
169**18. Enforcement**
170Progressive discipline: retraining → written warning → suspension/termination → civil liability → criminal referral. Factors: intent, severity, prior violations, self-reporting.
171
172**19. Policy Administration**
173- Review: annually or upon major incident, regulatory change, material org change
174- Approval: [CEO/Board] on CISO + General Counsel recommendation
175- Employees acknowledge receipt in writing; at-will status unaffected
176
177### Signature Block
178
179| Role | Name | Signature | Date |
180|------|------|-----------|------|
181| CEO | | | |
182| CISO | | | |
183| General Counsel | | | |
184
185### Employee Acknowledgment
186*I acknowledge receipt of, have read, and agree to comply with the Information Security Policy (Version [#], effective [Date]).*
187
188Name: ______ Title: ______ Date: ______ Signature: ______
189
190## Guidelines
191
192- **Multi-jurisdiction conflicts:** apply most stringent standard or add jurisdiction-specific schedules
193- **Encryption floors:** AES-256 / TLS 1.2+ are minimums; revise per NIST guidance updates
194- **GDPR DPO:** required if org is public authority, conducts large-scale monitoring, or processes special category data at scale — confirm applicability before drafting `[VERIFY]`
195- **HIPAA BAAs:** policy cross-references but does not replace BAA; maintain separate vendor register
196- **PCI DSS:** detailed technical controls in separate PCI documentation to allow updates without policy re-approval
197- **At-will disclaimer:** verify enforceability under applicable state law `[VERIFY]`
198- **Collective bargaining:** if unionized workforce, confirm no bargaining obligation before implementation
199- **Do not fabricate citations** — use `[VERIFY]` for any citation not confirmed against primary source
CaseMark