Information security policy
security policy · ISSP · information systems security policy · acceptable use policy · IT charter · PSSI
The reference document, approved by senior management, that sets out an organisation’s security objectives, rules and responsibilities (known in France as the PSSI).
In practice
The policy turns the risk analysis into rules people can apply: access management, passwords and MFA, backups, patching, remote work, use of suppliers, incident handling. It is broken down into more operational documents, including the IT charter for users, which in France generally has to be appended to the company’s internal rules to be enforceable against employees. A useful policy is short, signed by management, known to staff and reviewed at least once a year or after any major incident. ISO 27001 requires one, and it is a key piece of evidence of compliance with NIS2 or DORA.
Fictional case: after a ransomware attack, an SME realises that nothing prevented three technicians from sharing the same administrator account. Its new eight-page policy forbids it, makes MFA mandatory and schedules a backup restore test every quarter.
