Information Security Policy
Drafts a formal Information Security Policy satisfying multi-framework regulatory requirements with enforceable operational guidance.
Prerequisites
- Org profile — industry sector, employee count, jurisdictions of operation
- Regulatory triggers — applicable frameworks (HIPAA, GDPR, CCPA, GLBA, FERPA, PCI DSS, SOC 2, ISO 27001, NIST CSF)
- Existing governance docs — current policies, data classification schemes, incident response plans
- Data inventory — sensitive data categories handled (PHI, PII, payment card data, student records, trade secrets)
- Approving authority — CEO, Board, CISO, General Counsel signature blocks needed
Output Structure
Document Control Block
| Field |
Content |
| Policy Title |
Information Security Policy |
| Version / Effective Date |
[#] / [Date] |
| Approved By / Owner |
[Title] / CISO or equivalent |
| Next Review |
[Date + 1 year] |
| Supersedes |
[Prior version or N/A] |
Section Outline
1. Purpose & Authority
- Business rationale (financial, reputational, regulatory risk)
- Authorizing resolution; relationship to other org policies
2. Scope
- Entities: parent, subsidiaries, affiliates, JVs
- Personnel: employees, contractors, vendors, partners
- Assets: electronic data, physical records, IP, BYOD, remote environments
- Exclusions: publicly available info, de-identified data (define standard)
3. Definitions
Define with legal precision; flag where definitions vary by jurisdiction:
- Confidential Information, Personal Data / PII (per GDPR Art. 4, CCPA § 1798.140, HIPAA 45 C.F.R. § 160.103)
- Data Breach, Security Incident, Data Owner, Data Custodian, Authorized User
- Classification Levels: Public / Internal / Confidential / Restricted
4. Data Classification
| Level |
Description |
Examples |
| Public |
Approved for external release |
Marketing materials |
| Internal |
Business use; not for external distribution |
Org charts, internal memos |
| Confidential |
Limited distribution; legal obligations |
Customer PII, financial data |
| Restricted |
Highest sensitivity; regulatory protection |
PHI, payment card data, credentials |
5. Access Controls
- Least privilege; separation of duties
- Lifecycle: request → data owner approval → provisioning → quarterly review → revocation on role change/termination
- Privileged access: separate admin accounts; logged and audited
6. Authentication
| Requirement |
Standard |
| Password length |
12+ characters; mixed case, numbers, symbols |
| MFA required for |
Remote access, privileged accounts, Restricted data, cloud admin |
| Acceptable MFA |
TOTP, hardware token, biometric; SMS discouraged for high-risk |
| Shared credentials |
Prohibited |
7. Encryption Standards
| Context |
Minimum Standard |
| Data at rest (Confidential/Restricted) |
AES-256 |
| Data in transit |
TLS 1.2+ (1.3 preferred) |
| Portable devices |
Full-disk encryption |
| Email (Restricted) |
End-to-end or secure portal |
| Backup media |
Encrypted; separate key management |
Review annually; superseded by org Security Standards if more stringent.
8. Acceptable Use
- Prohibited: illegal activity, harassment, circumventing controls, credential sharing
- Monitoring: org reserves right; no expectation of privacy on org systems
- BYOD: MDM enrollment, encryption, remote wipe on loss/termination
9. Physical Security
- Lock unattended devices; clean desk for Confidential/Restricted materials
- Secure disposal: cross-cut shredding (paper); cryptographic erasure or destruction (media)
- Visitor access: escorted in secure areas; logs maintained
10. Data Retention & Disposal
| Category |
Period |
Basis |
| PHI |
6 years |
HIPAA 45 C.F.R. § 164.530(j) |
| Financial records |
7 years |
IRS / GLBA |
| Student records |
Per FERPA |
34 C.F.R. § 99 |
| Incident logs |
3 years min |
[Regulatory basis] |
Certificate of destruction required for Restricted data.
11. Roles & Responsibilities
| Role |
Obligations |
| Board / Exec |
Policy approval; resource allocation |
| CISO |
Program ownership; standards; audit; regulator liaison |
| IT / Security |
Controls; patching; monitoring; vulnerability mgmt |
| Legal / Privacy |
Breach notification decisions; regulatory liaison |
| Managers |
Access approval; team compliance; off-boarding |
| All Employees |
Credential protection; incident reporting; training |
| DPO |
Required under GDPR Art. 37 if applicable |
12. Incident Response
Lifecycle:
- Detect & Report — within [1–4 hours] to security hotline
- Assess — severity triage; activate IRT if Sev 1/2
- Contain — isolate systems; preserve evidence; chain of custody
- Eradicate — remove threat; patch vulnerability
- Recover — restore from clean backups; verify integrity
- Post-Incident Review — within 14 days; root cause; corrective action plan
IRT: CISO (lead), IT Security, Legal, HR, PR/Comms, Executive Sponsor.
13. Breach Notification
| Framework |
Deadline |
Recipients |
| HIPAA |
60 days (individuals); 60 days HHS + media if 500+ |
Individuals, HHS, media |
| GDPR |
72 hours to SA; without undue delay to individuals if high risk |
SA, affected individuals |
| CCPA/CPRA |
Expedient / without unreasonable delay |
Consumers; AG if 500+ CA |
| State laws |
30–90 days (varies) |
Residents, AGs, credit bureaus |
| PCI DSS |
Immediately |
Card brands, acquiring bank |
Legal counsel notified immediately upon any incident involving personal data.
14. Third-Party & Vendor Management
- Security assessment before vendor access to Confidential/Restricted data
- Required contractual provisions: DPA / BAA as applicable
- Right-to-audit for Restricted data vendors
- Access revoked immediately on contract termination
15. Regulatory Compliance Matrix
| Framework |
Applicability |
Key Requirements |
| HIPAA (45 C.F.R. §§ 164.302–318) |
Healthcare / PHI |
Admin, physical, technical safeguards; BAAs |
| GLBA (16 C.F.R. § 314) |
Financial institutions |
Risk assessment; safeguards; service provider oversight |
| FERPA (34 C.F.R. § 99) |
Education |
Student record protection; disclosure restrictions |
| GDPR |
EU personal data |
Lawful basis; data subject rights; DPIAs; SCCs |
| CCPA/CPRA |
CA residents |
Consumer rights; opt-out; privacy notice |
| PCI DSS v4.0 |
Payment cards |
Detailed controls in separate PCI procedures |
| NIST CSF 2.0 |
Voluntary |
Identify, Protect, Detect, Respond, Recover, Govern |
| ISO 27001 |
Voluntary |
ISMS; Annex A controls |
16. Training & Awareness
- All personnel: at hire + annually; phishing simulation semi-annually
- High-risk roles (sysadmins, developers, finance): role-specific training annually
- Completion tracked; non-completion escalated; records retained 3 years
17. Compliance Monitoring & Audit
- Annual risk assessment; quarterly vulnerability scans; annual penetration test
- Access reviews: semi-annual (Confidential), quarterly (Restricted)
- Remediation SLAs — Critical: 30 days, High: 60 days, Medium: 90 days
18. Enforcement
Progressive discipline: retraining → written warning → suspension/termination → civil liability → criminal referral. Factors: intent, severity, prior violations, self-reporting.
19. Policy Administration
- Review: annually or upon major incident, regulatory change, material org change
- Approval: [CEO/Board] on CISO + General Counsel recommendation
- Employees acknowledge receipt in writing; at-will status unaffected
Signature Block
| Role |
Name |
Signature |
Date |
| CEO |
|
|
|
| CISO |
|
|
|
| General Counsel |
|
|
|
Employee Acknowledgment
I acknowledge receipt of, have read, and agree to comply with the Information Security Policy (Version [#], effective [Date]).
Name: ______ Title: ______ Date: ______ Signature: ______
Guidelines
- Multi-jurisdiction conflicts: apply most stringent standard or add jurisdiction-specific schedules
- Encryption floors: AES-256 / TLS 1.2+ are minimums; revise per NIST guidance updates
- GDPR DPO: required if org is public authority, conducts large-scale monitoring, or processes special category data at scale — confirm applicability before drafting
[VERIFY]
- HIPAA BAAs: policy cross-references but does not replace BAA; maintain separate vendor register
- PCI DSS: detailed technical controls in separate PCI documentation to allow updates without policy re-approval
- At-will disclaimer: verify enforceability under applicable state law
[VERIFY]
- Collective bargaining: if unionized workforce, confirm no bargaining obligation before implementation
- Do not fabricate citations — use
[VERIFY] for any citation not confirmed against primary source
1---2name: information-security-policy3description: Drafts a board-approvable Information Security Policy covering data classification, access controls, encryption, incident response, breach notification, and enforcement. Tailored by industry and regulatory environment (HIPAA, GDPR, CCPA, GLBA, FERPA, PCI DSS). Use when drafting or overhauling an organization's foundational information security governance framework or cybersecurity policy.4license: Apache-2.05---67# Information Security Policy89Drafts a formal Information Security Policy satisfying multi-framework regulatory requirements with enforceable operational guidance.1011## Prerequisites12131. **Org profile** — industry sector, employee count, jurisdictions of operation142. **Regulatory triggers** — applicable frameworks (HIPAA, GDPR, CCPA, GLBA, FERPA, PCI DSS, SOC 2, ISO 27001, NIST CSF)153. **Existing governance docs** — current policies, data classification schemes, incident response plans164. **Data inventory** — sensitive data categories handled (PHI, PII, payment card data, student records, trade secrets)175. **Approving authority** — CEO, Board, CISO, General Counsel signature blocks needed1819## Output Structure2021### Document Control Block2223| Field | Content |24|-------|---------|25| Policy Title | Information Security Policy |26| Version / Effective Date | [#] / [Date] |27| Approved By / Owner | [Title] / CISO or equivalent |28| Next Review | [Date + 1 year] |29| Supersedes | [Prior version or N/A] |3031### Section Outline3233**1. Purpose & Authority**34- Business rationale (financial, reputational, regulatory risk)35- Authorizing resolution; relationship to other org policies3637**2. Scope**38- **Entities:** parent, subsidiaries, affiliates, JVs39- **Personnel:** employees, contractors, vendors, partners40- **Assets:** electronic data, physical records, IP, BYOD, remote environments41- **Exclusions:** publicly available info, de-identified data (define standard)4243**3. Definitions**44Define with legal precision; flag where definitions vary by jurisdiction:45- Confidential Information, Personal Data / PII (per GDPR Art. 4, CCPA § 1798.140, HIPAA 45 C.F.R. § 160.103)46- Data Breach, Security Incident, Data Owner, Data Custodian, Authorized User47- Classification Levels: Public / Internal / Confidential / Restricted4849**4. Data Classification**5051| Level | Description | Examples |52|-------|-------------|---------|53| Public | Approved for external release | Marketing materials |54| Internal | Business use; not for external distribution | Org charts, internal memos |55| Confidential | Limited distribution; legal obligations | Customer PII, financial data |56| Restricted | Highest sensitivity; regulatory protection | PHI, payment card data, credentials |5758**5. Access Controls**59- Least privilege; separation of duties60- Lifecycle: request → data owner approval → provisioning → quarterly review → revocation on role change/termination61- Privileged access: separate admin accounts; logged and audited6263**6. Authentication**6465| Requirement | Standard |66|-------------|---------|67| Password length | 12+ characters; mixed case, numbers, symbols |68| MFA required for | Remote access, privileged accounts, Restricted data, cloud admin |69| Acceptable MFA | TOTP, hardware token, biometric; SMS discouraged for high-risk |70| Shared credentials | Prohibited |7172**7. Encryption Standards**7374| Context | Minimum Standard |75|---------|-----------------|76| Data at rest (Confidential/Restricted) | AES-256 |77| Data in transit | TLS 1.2+ (1.3 preferred) |78| Portable devices | Full-disk encryption |79| Email (Restricted) | End-to-end or secure portal |80| Backup media | Encrypted; separate key management |8182Review annually; superseded by org Security Standards if more stringent.8384**8. Acceptable Use**85- Prohibited: illegal activity, harassment, circumventing controls, credential sharing86- Monitoring: org reserves right; no expectation of privacy on org systems87- BYOD: MDM enrollment, encryption, remote wipe on loss/termination8889**9. Physical Security**90- Lock unattended devices; clean desk for Confidential/Restricted materials91- Secure disposal: cross-cut shredding (paper); cryptographic erasure or destruction (media)92- Visitor access: escorted in secure areas; logs maintained9394**10. Data Retention & Disposal**9596| Category | Period | Basis |97|----------|--------|-------|98| PHI | 6 years | HIPAA 45 C.F.R. § 164.530(j) |99| Financial records | 7 years | IRS / GLBA |100| Student records | Per FERPA | 34 C.F.R. § 99 |101| Incident logs | 3 years min | [Regulatory basis] |102103Certificate of destruction required for Restricted data.104105**11. Roles & Responsibilities**106107| Role | Obligations |108|------|-------------|109| Board / Exec | Policy approval; resource allocation |110| CISO | Program ownership; standards; audit; regulator liaison |111| IT / Security | Controls; patching; monitoring; vulnerability mgmt |112| Legal / Privacy | Breach notification decisions; regulatory liaison |113| Managers | Access approval; team compliance; off-boarding |114| All Employees | Credential protection; incident reporting; training |115| DPO | Required under GDPR Art. 37 if applicable |116117**12. Incident Response**118119Lifecycle:1201. **Detect & Report** — within [1–4 hours] to security hotline1212. **Assess** — severity triage; activate IRT if Sev 1/21223. **Contain** — isolate systems; preserve evidence; chain of custody1234. **Eradicate** — remove threat; patch vulnerability1245. **Recover** — restore from clean backups; verify integrity1256. **Post-Incident Review** — within 14 days; root cause; corrective action plan126127IRT: CISO (lead), IT Security, Legal, HR, PR/Comms, Executive Sponsor.128129**13. Breach Notification**130131| Framework | Deadline | Recipients |132|-----------|----------|-----------|133| HIPAA | 60 days (individuals); 60 days HHS + media if 500+ | Individuals, HHS, media |134| GDPR | 72 hours to SA; without undue delay to individuals if high risk | SA, affected individuals |135| CCPA/CPRA | Expedient / without unreasonable delay | Consumers; AG if 500+ CA |136| State laws | 30–90 days (varies) | Residents, AGs, credit bureaus |137| PCI DSS | Immediately | Card brands, acquiring bank |138139Legal counsel notified immediately upon any incident involving personal data.140141**14. Third-Party & Vendor Management**142- Security assessment before vendor access to Confidential/Restricted data143- Required contractual provisions: DPA / BAA as applicable144- Right-to-audit for Restricted data vendors145- Access revoked immediately on contract termination146147**15. Regulatory Compliance Matrix**148149| Framework | Applicability | Key Requirements |150|-----------|--------------|-----------------|151| HIPAA (45 C.F.R. §§ 164.302–318) | Healthcare / PHI | Admin, physical, technical safeguards; BAAs |152| GLBA (16 C.F.R. § 314) | Financial institutions | Risk assessment; safeguards; service provider oversight |153| FERPA (34 C.F.R. § 99) | Education | Student record protection; disclosure restrictions |154| GDPR | EU personal data | Lawful basis; data subject rights; DPIAs; SCCs |155| CCPA/CPRA | CA residents | Consumer rights; opt-out; privacy notice |156| PCI DSS v4.0 | Payment cards | Detailed controls in separate PCI procedures |157| NIST CSF 2.0 | Voluntary | Identify, Protect, Detect, Respond, Recover, Govern |158| ISO 27001 | Voluntary | ISMS; Annex A controls |159160**16. Training & Awareness**161- All personnel: at hire + annually; phishing simulation semi-annually162- High-risk roles (sysadmins, developers, finance): role-specific training annually163- Completion tracked; non-completion escalated; records retained 3 years164165**17. Compliance Monitoring & Audit**166- Annual risk assessment; quarterly vulnerability scans; annual penetration test167- Access reviews: semi-annual (Confidential), quarterly (Restricted)168- Remediation SLAs — Critical: 30 days, High: 60 days, Medium: 90 days169170**18. Enforcement**171Progressive discipline: retraining → written warning → suspension/termination → civil liability → criminal referral. Factors: intent, severity, prior violations, self-reporting.172173**19. Policy Administration**174- Review: annually or upon major incident, regulatory change, material org change175- Approval: [CEO/Board] on CISO + General Counsel recommendation176- Employees acknowledge receipt in writing; at-will status unaffected177178### Signature Block179180| Role | Name | Signature | Date |181|------|------|-----------|------|182| CEO | | | |183| CISO | | | |184| General Counsel | | | |185186### Employee Acknowledgment187*I acknowledge receipt of, have read, and agree to comply with the Information Security Policy (Version [#], effective [Date]).*188189Name: ______ Title: ______ Date: ______ Signature: ______190191## Guidelines192193- **Multi-jurisdiction conflicts:** apply most stringent standard or add jurisdiction-specific schedules194- **Encryption floors:** AES-256 / TLS 1.2+ are minimums; revise per NIST guidance updates195- **GDPR DPO:** required if org is public authority, conducts large-scale monitoring, or processes special category data at scale — confirm applicability before drafting `[VERIFY]`196- **HIPAA BAAs:** policy cross-references but does not replace BAA; maintain separate vendor register197- **PCI DSS:** detailed technical controls in separate PCI documentation to allow updates without policy re-approval198- **At-will disclaimer:** verify enforceability under applicable state law `[VERIFY]`199- **Collective bargaining:** if unionized workforce, confirm no bargaining obligation before implementation200- **Do not fabricate citations** — use `[VERIFY]` for any citation not confirmed against primary source
ThomasMoreAI