Security Policies

• After threat analysis, develop security policies

• Policies provide guidance

  • to employees in ongoing operations,
  • to security/system administration staff
  • should be at an appropriate level of detail
    • should not need frequent revision for new technology (or other reasons)