Re: Policy-Procedure connection

Again, I recommend the ISF Standard of Good Practice, which encompasses 
ISO 17799 (it's a great complement to the ISO standard), and gives 
specific implementation specifications with regard to ownership review, 
etc. Based on our experience over the past year, I highly recommend it.
It's available for no charge at http://www.isfsecuritystandard.com/
--- Alan Willcox
The Vanguard Group
("The views expressed here are mine and do not reflect the official opinion 
of my employer or the organization through which the Internet was 
accessed".)





"Sharon Steinbock" <sharon@mimransteinbock.com>
10/18/2004 04:07 AM

 
        To:     <security-management@securityfocus.com>
        cc: 
        Subject:        Policy-Procedure connection





Hello,

I am looking at implementing an ISO 17799 framework.
Getting the policies right is not an easy task, but I find the topic
well documented, with many sample policies I can use.
However, when it comes down to "translating" my policies to specific
procedures I am lost. Some questions:
- Who should write each procedure? The procedure owner, his boss,
someone higher up?
- Where can I find some sample procedures?

Any other insight regarding the policy-procedure gap will be highly
appreciated.

Thanks,
Sharon