Information Security Policy
Drafts a formal Information Security Policy satisfying multi-framework regulatory requirements with enforceable operational guidance.
Prerequisites
- Org profile — industry sector, employee count, jurisdictions of operation
- Regulatory triggers — applicable frameworks (HIPAA, GDPR, CCPA, GLBA, FERPA, PCI DSS, SOC 2, ISO 27001, NIST CSF)
- Existing governance docs — current policies, data classification schemes, incident response plans
- Data inventory — sensitive data categories handled (PHI, PII, payment card data, student records, trade secrets)
- Approving authority — CEO, Board, CISO, General Counsel signature blocks needed
Output Structure
Document Control Block
| Field |
Content |
| Policy Title |
Information Security Policy |
| Version / Effective Date |
[#] / [Date] |
| Approved By / Owner |
[Title] / CISO or equivalent |
| Next Review |
[Date + 1 year] |
| Supersedes |
[Prior version or N/A] |
Section Outline
1. Purpose & Authority
- Business rationale (financial, reputational, regulatory risk)
- Authorizing resolution; relationship to other org policies
2. Scope
- Entities: parent, subsidiaries, affiliates, JVs
- Personnel: employees, contractors, vendors, partners
- Assets: electronic data, physical records, IP, BYOD, remote environments
- Exclusions: publicly available info, de-identified data (define standard)
3. Definitions
Define with legal precision; flag where definitions vary by jurisdiction:
- Confidential Information, Personal Data / PII (per GDPR Art. 4, CCPA § 1798.140, HIPAA 45 C.F.R. § 160.103)
- Data Breach, Security Incident, Data Owner, Data Custodian, Authorized User
- Classification Levels: Public / Internal / Confidential / Restricted
4. Data Classification
| Level |
Description |
Examples |
| Public |
Approved for external release |
Marketing materials |
| Internal |
Business use; not for external distribution |
Org charts, internal memos |
| Confidential |
Limited distribution; legal obligations |
Customer PII, financial data |
| Restricted |
Highest sensitivity; regulatory protection |
PHI, payment card data, credentials |
5. Access Controls
- Least privilege; separation of duties
- Lifecycle: request → data owner approval → provisioning → quarterly review → revocation on role change/termination
- Privileged access: separate admin accounts; logged and audited
6. Authentication
| Requirement |
Standard |
| Password length |
12+ characters; mixed case, numbers, symbols |
| MFA required for |
Remote access, privileged accounts, Restricted data, cloud admin |
| Acceptable MFA |
TOTP, hardware token, biometric; SMS discouraged for high-risk |
| Shared credentials |
Prohibited |
7. Encryption Standards
| Context |
Minimum Standard |
| Data at rest (Confidential/Restricted) |
AES-256 |
| Data in transit |
TLS 1.2+ (1.3 preferred) |
| Portable devices |
Full-disk encryption |
| Email (Restricted) |
End-to-end or secure portal |
| Backup media |
Encrypted; separate key management |
Review annually; superseded by org Security Standards if more stringent.
8. Acceptable Use
- Prohibited: illegal activity, harassment, circumventing controls, credential sharing
- Monitoring: org reserves right; no expectation of privacy on org systems
- BYOD: MDM enrollment, encryption, remote wipe on loss/termination
9. Physical Security
- Lock unattended devices; clean desk for Confidential/Restricted materials
- Secure disposal: cross-cut shredding (paper); cryptographic erasure or destruction (media)
- Visitor access: escorted in secure areas; logs maintained
10. Data Retention & Disposal
| Category |
Period |
Basis |
| PHI |
6 years |
HIPAA 45 C.F.R. § 164.530(j) |
| Financial records |
7 years |
IRS / GLBA |
| Student records |
Per FERPA |
34 C.F.R. § 99 |
| Incident logs |
3 years min |
[Regulatory basis] |
Certificate of destruction required for Restricted data.
11. Roles & Responsibilities
| Role |
Obligations |
| Board / Exec |
Policy approval; resource allocation |
| CISO |
Program ownership; standards; audit; regulator liaison |
| IT / Security |
Controls; patching; monitoring; vulnerability mgmt |
| Legal / Privacy |
Breach notification decisions; regulatory liaison |
| Managers |
Access approval; team compliance; off-boarding |
| All Employees |
Credential protection; incident reporting; training |
| DPO |
Required under GDPR Art. 37 if applicable |
12. Incident Response
Lifecycle:
- Detect & Report — within [1–4 hours] to security hotline
- Assess — severity triage; activate IRT if Sev 1/2
- Contain — isolate systems; preserve evidence; chain of custody
- Eradicate — remove threat; patch vulnerability
- Recover — restore from clean backups; verify integrity
- Post-Incident Review — within 14 days; root cause; corrective action plan
IRT: CISO (lead), IT Security, Legal, HR, PR/Comms, Executive Sponsor.
13. Breach Notification
| Framework |
Deadline |
Recipients |
| HIPAA |
60 days (individuals); 60 days HHS + media if 500+ |
Individuals, HHS, media |
| GDPR |
72 hours to SA; without undue delay to individuals if high risk |
SA, affected individuals |
| CCPA/CPRA |
Expedient / without unreasonable delay |
Consumers; AG if 500+ CA |
| State laws |
30–90 days (varies) |
Residents, AGs, credit bureaus |
| PCI DSS |
Immediately |
Card brands, acquiring bank |
Legal counsel notified immediately upon any incident involving personal data.
14. Third-Party & Vendor Management
- Security assessment before vendor access to Confidential/Restricted data
- Required contractual provisions: DPA / BAA as applicable
- Right-to-audit for Restricted data vendors
- Access revoked immediately on contract termination
15. Regulatory Compliance Matrix
| Framework |
Applicability |
Key Requirements |
| HIPAA (45 C.F.R. §§ 164.302–318) |
Healthcare / PHI |
Admin, physical, technical safeguards; BAAs |
| GLBA (16 C.F.R. § 314) |
Financial institutions |
Risk assessment; safeguards; service provider oversight |
| FERPA (34 C.F.R. § 99) |
Education |
Student record protection; disclosure restrictions |
| GDPR |
EU personal data |
Lawful basis; data subject rights; DPIAs; SCCs |
| CCPA/CPRA |
CA residents |
Consumer rights; opt-out; privacy notice |
| PCI DSS v4.0 |
Payment cards |
Detailed controls in separate PCI procedures |
| NIST CSF 2.0 |
Voluntary |
Identify, Protect, Detect, Respond, Recover, Govern |
| ISO 27001 |
Voluntary |
ISMS; Annex A controls |
16. Training & Awareness
- All personnel: at hire + annually; phishing simulation semi-annually
- High-risk roles (sysadmins, developers, finance): role-specific training annually
- Completion tracked; non-completion escalated; records retained 3 years
17. Compliance Monitoring & Audit
- Annual risk assessment; quarterly vulnerability scans; annual penetration test
- Access reviews: semi-annual (Confidential), quarterly (Restricted)
- Remediation SLAs — Critical: 30 days, High: 60 days, Medium: 90 days
18. Enforcement
Progressive discipline: retraining → written warning → suspension/termination → civil liability → criminal referral. Factors: intent, severity, prior violations, self-reporting.
19. Policy Administration
- Review: annually or upon major incident, regulatory change, material org change
- Approval: [CEO/Board] on CISO + General Counsel recommendation
- Employees acknowledge receipt in writing; at-will status unaffected
Signature Block
| Role |
Name |
Signature |
Date |
| CEO |
|
|
|
| CISO |
|
|
|
| General Counsel |
|
|
|
Employee Acknowledgment
I acknowledge receipt of, have read, and agree to comply with the Information Security Policy (Version [#], effective [Date]).
Name: ______ Title: ______ Date: ______ Signature: ______
Guidelines
- Multi-jurisdiction conflicts: apply most stringent standard or add jurisdiction-specific schedules
- Encryption floors: AES-256 / TLS 1.2+ are minimums; revise per NIST guidance updates
- GDPR DPO: required if org is public authority, conducts large-scale monitoring, or processes special category data at scale — confirm applicability before drafting
[VERIFY]
- HIPAA BAAs: policy cross-references but does not replace BAA; maintain separate vendor register
- PCI DSS: detailed technical controls in separate PCI documentation to allow updates without policy re-approval
- At-will disclaimer: verify enforceability under applicable state law
[VERIFY]
- Collective bargaining: if unionized workforce, confirm no bargaining obligation before implementation
- Do not fabricate citations — use
[VERIFY] for any citation not confirmed against primary source
1---2name: information-security-policy3description: Drafts a board-approvable Information Security Policy covering data classification, access controls, encryption, incident response, breach notification, and enforcement. Tailored by industry and regulatory environment (HIPAA, GDPR, CCPA, GLBA, FERPA, PCI DSS). Use when drafting or overhauling an organization's foundational information security governance framework or cybersecurity policy.4---56# Information Security Policy78Drafts a formal Information Security Policy satisfying multi-framework regulatory requirements with enforceable operational guidance.910## Prerequisites11121. **Org profile** — industry sector, employee count, jurisdictions of operation132. **Regulatory triggers** — applicable frameworks (HIPAA, GDPR, CCPA, GLBA, FERPA, PCI DSS, SOC 2, ISO 27001, NIST CSF)143. **Existing governance docs** — current policies, data classification schemes, incident response plans154. **Data inventory** — sensitive data categories handled (PHI, PII, payment card data, student records, trade secrets)165. **Approving authority** — CEO, Board, CISO, General Counsel signature blocks needed1718## Output Structure1920### Document Control Block2122| Field | Content |23|-------|---------|24| Policy Title | Information Security Policy |25| Version / Effective Date | [#] / [Date] |26| Approved By / Owner | [Title] / CISO or equivalent |27| Next Review | [Date + 1 year] |28| Supersedes | [Prior version or N/A] |2930### Section Outline3132**1. Purpose & Authority**33- Business rationale (financial, reputational, regulatory risk)34- Authorizing resolution; relationship to other org policies3536**2. Scope**37- **Entities:** parent, subsidiaries, affiliates, JVs38- **Personnel:** employees, contractors, vendors, partners39- **Assets:** electronic data, physical records, IP, BYOD, remote environments40- **Exclusions:** publicly available info, de-identified data (define standard)4142**3. Definitions**43Define with legal precision; flag where definitions vary by jurisdiction:44- Confidential Information, Personal Data / PII (per GDPR Art. 4, CCPA § 1798.140, HIPAA 45 C.F.R. § 160.103)45- Data Breach, Security Incident, Data Owner, Data Custodian, Authorized User46- Classification Levels: Public / Internal / Confidential / Restricted4748**4. Data Classification**4950| Level | Description | Examples |51|-------|-------------|---------|52| Public | Approved for external release | Marketing materials |53| Internal | Business use; not for external distribution | Org charts, internal memos |54| Confidential | Limited distribution; legal obligations | Customer PII, financial data |55| Restricted | Highest sensitivity; regulatory protection | PHI, payment card data, credentials |5657**5. Access Controls**58- Least privilege; separation of duties59- Lifecycle: request → data owner approval → provisioning → quarterly review → revocation on role change/termination60- Privileged access: separate admin accounts; logged and audited6162**6. Authentication**6364| Requirement | Standard |65|-------------|---------|66| Password length | 12+ characters; mixed case, numbers, symbols |67| MFA required for | Remote access, privileged accounts, Restricted data, cloud admin |68| Acceptable MFA | TOTP, hardware token, biometric; SMS discouraged for high-risk |69| Shared credentials | Prohibited |7071**7. Encryption Standards**7273| Context | Minimum Standard |74|---------|-----------------|75| Data at rest (Confidential/Restricted) | AES-256 |76| Data in transit | TLS 1.2+ (1.3 preferred) |77| Portable devices | Full-disk encryption |78| Email (Restricted) | End-to-end or secure portal |79| Backup media | Encrypted; separate key management |8081Review annually; superseded by org Security Standards if more stringent.8283**8. Acceptable Use**84- Prohibited: illegal activity, harassment, circumventing controls, credential sharing85- Monitoring: org reserves right; no expectation of privacy on org systems86- BYOD: MDM enrollment, encryption, remote wipe on loss/termination8788**9. Physical Security**89- Lock unattended devices; clean desk for Confidential/Restricted materials90- Secure disposal: cross-cut shredding (paper); cryptographic erasure or destruction (media)91- Visitor access: escorted in secure areas; logs maintained9293**10. Data Retention & Disposal**9495| Category | Period | Basis |96|----------|--------|-------|97| PHI | 6 years | HIPAA 45 C.F.R. § 164.530(j) |98| Financial records | 7 years | IRS / GLBA |99| Student records | Per FERPA | 34 C.F.R. § 99 |100| Incident logs | 3 years min | [Regulatory basis] |101102Certificate of destruction required for Restricted data.103104**11. Roles & Responsibilities**105106| Role | Obligations |107|------|-------------|108| Board / Exec | Policy approval; resource allocation |109| CISO | Program ownership; standards; audit; regulator liaison |110| IT / Security | Controls; patching; monitoring; vulnerability mgmt |111| Legal / Privacy | Breach notification decisions; regulatory liaison |112| Managers | Access approval; team compliance; off-boarding |113| All Employees | Credential protection; incident reporting; training |114| DPO | Required under GDPR Art. 37 if applicable |115116**12. Incident Response**117118Lifecycle:1191. **Detect & Report** — within [1–4 hours] to security hotline1202. **Assess** — severity triage; activate IRT if Sev 1/21213. **Contain** — isolate systems; preserve evidence; chain of custody1224. **Eradicate** — remove threat; patch vulnerability1235. **Recover** — restore from clean backups; verify integrity1246. **Post-Incident Review** — within 14 days; root cause; corrective action plan125126IRT: CISO (lead), IT Security, Legal, HR, PR/Comms, Executive Sponsor.127128**13. Breach Notification**129130| Framework | Deadline | Recipients |131|-----------|----------|-----------|132| HIPAA | 60 days (individuals); 60 days HHS + media if 500+ | Individuals, HHS, media |133| GDPR | 72 hours to SA; without undue delay to individuals if high risk | SA, affected individuals |134| CCPA/CPRA | Expedient / without unreasonable delay | Consumers; AG if 500+ CA |135| State laws | 30–90 days (varies) | Residents, AGs, credit bureaus |136| PCI DSS | Immediately | Card brands, acquiring bank |137138Legal counsel notified immediately upon any incident involving personal data.139140**14. Third-Party & Vendor Management**141- Security assessment before vendor access to Confidential/Restricted data142- Required contractual provisions: DPA / BAA as applicable143- Right-to-audit for Restricted data vendors144- Access revoked immediately on contract termination145146**15. Regulatory Compliance Matrix**147148| Framework | Applicability | Key Requirements |149|-----------|--------------|-----------------|150| HIPAA (45 C.F.R. §§ 164.302–318) | Healthcare / PHI | Admin, physical, technical safeguards; BAAs |151| GLBA (16 C.F.R. § 314) | Financial institutions | Risk assessment; safeguards; service provider oversight |152| FERPA (34 C.F.R. § 99) | Education | Student record protection; disclosure restrictions |153| GDPR | EU personal data | Lawful basis; data subject rights; DPIAs; SCCs |154| CCPA/CPRA | CA residents | Consumer rights; opt-out; privacy notice |155| PCI DSS v4.0 | Payment cards | Detailed controls in separate PCI procedures |156| NIST CSF 2.0 | Voluntary | Identify, Protect, Detect, Respond, Recover, Govern |157| ISO 27001 | Voluntary | ISMS; Annex A controls |158159**16. Training & Awareness**160- All personnel: at hire + annually; phishing simulation semi-annually161- High-risk roles (sysadmins, developers, finance): role-specific training annually162- Completion tracked; non-completion escalated; records retained 3 years163164**17. Compliance Monitoring & Audit**165- Annual risk assessment; quarterly vulnerability scans; annual penetration test166- Access reviews: semi-annual (Confidential), quarterly (Restricted)167- Remediation SLAs — Critical: 30 days, High: 60 days, Medium: 90 days168169**18. Enforcement**170Progressive discipline: retraining → written warning → suspension/termination → civil liability → criminal referral. Factors: intent, severity, prior violations, self-reporting.171172**19. Policy Administration**173- Review: annually or upon major incident, regulatory change, material org change174- Approval: [CEO/Board] on CISO + General Counsel recommendation175- Employees acknowledge receipt in writing; at-will status unaffected176177### Signature Block178179| Role | Name | Signature | Date |180|------|------|-----------|------|181| CEO | | | |182| CISO | | | |183| General Counsel | | | |184185### Employee Acknowledgment186*I acknowledge receipt of, have read, and agree to comply with the Information Security Policy (Version [#], effective [Date]).*187188Name: ______ Title: ______ Date: ______ Signature: ______189190## Guidelines191192- **Multi-jurisdiction conflicts:** apply most stringent standard or add jurisdiction-specific schedules193- **Encryption floors:** AES-256 / TLS 1.2+ are minimums; revise per NIST guidance updates194- **GDPR DPO:** required if org is public authority, conducts large-scale monitoring, or processes special category data at scale — confirm applicability before drafting `[VERIFY]`195- **HIPAA BAAs:** policy cross-references but does not replace BAA; maintain separate vendor register196- **PCI DSS:** detailed technical controls in separate PCI documentation to allow updates without policy re-approval197- **At-will disclaimer:** verify enforceability under applicable state law `[VERIFY]`198- **Collective bargaining:** if unionized workforce, confirm no bargaining obligation before implementation199- **Do not fabricate citations** — use `[VERIFY]` for any citation not confirmed against primary source
lev-os