Keep It Flexible

For a security policy to be viable over the long term, it must be as flexible as possible, allowing for growth and changes within the architecture. As much as possible, the policy should be independent from specific hardware and software because these items can be moved or removed on short notice.

The processes for updating the policies should be defined in detail to include the steps to do, the people to include, and who must sign-off on the resulting changes.

Finally, the policies must be reviewed on a regular basis to make sure they’re successfully meeting the company security needs. The policies should also be reviewed if any new major technology is added to the network to make sure the technology is covered from day one.