Creating a Security Policy Framework That works
summary
Explains a working program: consolidate policies into one source of truth (indexed PDF library or SharePoint), enforce an annual review lifecycle with automated notifications and quarterly briefings, use a daisy model of drivers approvers contributors informed, brand policies for quick recognition, and route exceptions through a form backed by an Archer‑based in‑house tool that forbids exceptions limited to one year. Claims this reduced document sprawl, improved buy‑in by involving implementers, and made approvals and histories auditable and repeatable.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:35Scenarios
- 2:02Governing Documents
- 3:59Governance Structure
- 4:55Policy Language
- 7:53Compliance
- 9:26Structure
- 11:16Source of truth
- 14:40Review Cycle
- 16:18Managing Changes
- 17:58Uniform Branding
- 19:17Exceptions
- 19:56Summary
- 21:34Benefits
related talks
10mAccelerated Readiness with Global Compliance Patterns: The Winning...
51mPermissions: Centralized or Decentralized? Both!
49mParlez-Vous Policies? Translate Policies into Powerful Development Tools
38mBuilding a Security Assurance Program
45mSecurity Architecture, An Adventure?
37mSecurity Through Transparency: Scaling Your Customer Trust Program
45mSecuring the Future: Modernising Singapore Government IT Policy Throug...
26mImproving authentication policy enforcement for government resources