Section 27.260 Policy and Handbooks

Question 1

Policies and Handbooks

Policy

Answer 1

A system of principles and rules guiding decisions, ensuring compliance
with legal and ethical standards

Question 2

Policies and Handbooks

Handbook

Answer 2

A comprehensive guide providing detailed information on procedures, guidelines, and best practices

Question 3

Policies and Handbooks

Answer 3

■ Policies and handbooks are living guidelines that shape behavior and decision-making in organisations

■ These documents vary between organisations based on industry, needs, and use
cases

■ Importance of not just reading but understanding the policies and handbooks

Question 4

Scope of Policies and Handbooks

Answer 4

■ Cover various aspects in an organisation, e.g data protection, remote work,
technology use, conflicts of interest

■ Different handbooks for different aspects, e.g., Employee Handbook, Training
Handbook, Compliance Handbook

Question 5

Data Destruction Policy Example

Answer 5

■ Some policies may define rules for data disposal, e.g., shredding

■ Color-coded paper for document classification

■ Shredding of sensitive documents to prevent data breaches

Question 6

Remote Work and Data Protection

Answer 6

■ Organisations may have strict guidelines regarding remote work

■ Policies cover physical files and digital files that leave the office

■ Restrictions on what can be taken home or worked on remotely

Question 7

Policy Guidance for Daily Responsibilities

Answer 7

■ Provide guidance on handling various situations, e.g., data breaches, reporting
suspicious activity

■ Ensures employees know how to respond to specific scenarios

Question 8

Policy and Handbook Updates

Answer 8

■ Policies and handbooks should be reviewed at least annually

■ Updates to reflect changing cybersecurity landscape

■ Employee awareness of policy updates and significant changes is crucial

Question 9

Human Judgment and Culture of Security

Answer 9

■ Policies and handbooks may not cover every scenario

■ Employees should understand the “why” behind the policies to make judgment
calls

■ Creating a culture of security involves reporting gaps and fostering a secure
environment

Question 10

Importance of Employee Involvement

Answer 10

■ Encourage employees to bring up concerns and questions

■ Open communication with management and leadership teams

■ Collective responsibility in promoting a secure organization culture