Policy and procedure writing workshop
You write the core documents, from the information security policy to acceptable use, access, password, classification, backup and incident policies, turn them into procedures and manage their lifecycle.
Level 201 · 21 lessons · 18 practice labs
Lessons
Writing principles
- What makes a good policy
- The policy template: purpose, scope, rules, responsibilities
- Plain language: "must" versus "should"
- Quick task: fix a badly written policy
Core policies
- The information security policy
- The acceptable use policy
- The access control policy
- The password and authentication standard
- The data classification and labelling policy
- Quick task: an acceptable use policy for a remote team
Operational policies
- The backup policy
- The incident response policy
- The change management policy
- The supplier security policy
- The remote working and personal device policy
- Quick task: a backup policy and standard
Procedure and lifecycle
- From policy to step-by-step procedure
- Review, approval and publication
- The exception process
- Attestation and compliance tracking
- Capstone: a policy set for a fifty-person company
Practice labs
- Separate must from should: Find the vague wording in twenty rule sentences and rewrite each as a requirement or a recommendation.
- Fix a badly written policy: Rewrite a one-page policy full of long, passive and unmeasurable statements so it is plain and auditable.
- Rebuild a policy to the template: Reorganise a document whose purpose, scope and responsibilities are tangled under the template headings and write the missing sections.
- Classify acceptable use rules: Mark fifteen behaviours as allowed, prohibited or subject to approval under an acceptable use policy.
- An acceptable use policy for a remote team: Write a policy with device, account, data and communication rules for a fully remote team of thirty.
- Write the information security policy: Write a top-level policy for Karaçam Mobilya with management commitment, objectives, roles and references to supporting policies.
- Find the outdated rules in a password standard: Mark the rules in a password standard that conflict with current good practice (forced frequent change, complexity fixation).
- Clauses for the access control policy: Write eight measurable policy clauses for access request, approval, review and removal.
- Write the authentication standard: Write a standard with password length, multi-factor and lockout values for staff, administrator and service accounts.
- Give the document the right label: Label twelve documents according to the given classification policy.
- A handling table per class: Fill in a table of storage, sharing, printing and destruction rules for four classes.
- Draft the classification policy: Write a policy for Sedirli Hukuk Bürosu with class definitions, labelling, ownership and reclassification rules.
- Find the missing values in the backup policy: Mark which of frequency, retention, location and restore test values are missing from a backup policy.
- A backup policy and standard: From the given recovery objectives, write a one-page policy and a standard with per-system values.
- Align the change and supplier policies: Find the overlapping and conflicting clauses in the change management and supplier security policies and make the two consistent.
- Derive procedure steps from a policy: Turn a leaver policy clause into an eight-step procedure that answers who, when and with what record.
- Assess an exception request: Assess a password policy exception for an old production machine by risk, compensating controls and duration and write your decision.
- Set up approval and attestation tracking: Prepare a tracker of review dates, approvers and attestation rates for ten policies of a fifty-person company.
About this course
You write the core documents, from the information security policy to acceptable use, access, password, classification, backup and incident policies, turn them into procedures and manage their lifecycle.
What you will learn
- Writing principles
- Core policies
- Operational policies
- Procedure and lifecycle
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.