An organization building an internal information security management system is drafting a top-level security policy, functional policies for areas such as access control and data classification, and a policy governing use of cloud services. How should these policies relate to each other?
Select an answer to reveal the explanation.
Short Explanation
Think of the policy set as a family tree: the organizational policy is the trunk, and the functional and cloud policies are branches growing out of it. A branch never overrules the trunk. The trap is letting a cloud or functional policy go rogue, or borrowing your provider's rules as if they were yours.
Full Explanation
An ISMS establishes a policy hierarchy. The organizational, or top-level, information security policy is approved by senior management, states objectives and commitments and gives overall direction. Functional policies address specific areas such as access control, cryptography, data classification or incident response, and cloud computing policies address how cloud services are selected, approved and used. Both sit beneath the organizational policy and must be consistent with it, with standards, procedures and guidelines providing the detail below them. Letting cloud policies replace the organizational policy for off-premises workloads fragments governance and leaves cloud systems outside the commitments that apply everywhere else. Allowing functional policies to override the top-level policy inverts the hierarchy; conflicts are resolved by revising the lower document so it aligns, not by ignoring senior management direction. Adopting the provider's acceptable use policy as the organization's own confuses the provider's rules for its customers with the customer's governance of its own use, risk appetite and responsibilities under shared responsibility. Exam caveat: ISO/IEC 27001 expects policies to be reviewed at planned intervals and when significant changes such as cloud adoption occur. Operational check: confirm each lower-level policy cites the organizational policy it supports and has an owner, approval record and review date.