Security Policies

• After threat analysis, develop security policies

• Policies provide guidance

  • to employees in ongoing operations,
  • to security/system administration staff

• Develop policies before a crisis hits