Information Security Policies and Practices

Introduction
Information security has moved from being a purely technical IT concern to a board-level enterprise risk. For the IIA Certification in Risk Management Assurance (CRMA), the topic of Information Security Policies and Practices sits within the domain of Evaluating Risk Management Processes. The exam does not expect you to be a network engineer or a cryptographer. It expects you to think like an assurance professional who can evaluate whether an organization has designed and operates a sound framework for protecting its information assets, and whether that framework is aligned with the organization's risk appetite, governance structure, and strategic objectives.

This guide explains why information security policies matter, what they consist of, how an effective information security program actually works, and how to approach CRMA exam questions on this subject with confidence.

Part 1: Why Information Security Policies and Practices Are Important

1.1 Information is a critical enterprise asset
Virtually every organization depends on information to operate: customer data, financial records, intellectual property, employee information, strategic plans, and operational data. A loss of confidentiality, integrity, or availability of this information can lead to financial loss, regulatory penalties, reputational damage, legal liability, and even the inability to continue operations. Because of this, information security is inseparable from enterprise risk management (ERM).

1.2 Policies translate risk appetite into action
A board and senior management set the organization's risk appetite. Information security policies are the mechanism that translates that appetite into concrete expectations for behavior, technology configuration, and accountability. Without documented policies, employees and third parties have no consistent reference point for what is acceptable, and management has no basis for enforcement or measurement.

1.3 Regulatory and contractual drivers
Organizations face a growing body of legal and regulatory obligations: data protection and privacy laws (such as GDPR and various national privacy statutes), sector-specific rules (banking, healthcare, payment card industry standards), and contractual commitments to customers and partners. Policies provide evidence of due diligence and a structured basis for demonstrating compliance.

1.4 The role of the risk management assurance professional
From a CRMA perspective, the key reason this topic matters is that internal auditors and risk assurance providers are expected to evaluate the design adequacy and operating effectiveness of the information security risk management process. The CRMA candidate must understand enough about information security governance to assess whether:
- Risks to information assets are identified and assessed systematically.
- Policies exist, are approved at the appropriate level, and are communicated.
- Controls are aligned with the identified risks and the policies.
- Monitoring and reporting mechanisms give management and the board reliable insight.
- The program is improved continuously in response to changes in threats and the business environment.

Part 2: What Information Security Policies and Practices Are

2.1 Core definitions
Information security is the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. It is commonly described through the CIA triad:
- Confidentiality: Information is accessible only to those authorized to have access.
- Integrity: Information is accurate, complete, and protected from unauthorized modification.
- Availability: Information and systems are accessible to authorized users when needed.

Some frameworks extend these with authenticity, accountability, and non-repudiation, but the CIA triad is the foundational model the exam most frequently references.

2.2 The policy hierarchy
Information security documentation is typically organized in a hierarchy, and recognizing the distinction between levels is a frequent exam point:
- Policy: A high-level statement of management intent, approved by senior management or the board. It states what must be done and why, assigns accountability, and is relatively stable over time. Example: an Acceptable Use Policy or an overarching Information Security Policy.
- Standards: Mandatory requirements that support the policy by specifying specific measurable requirements, such as minimum password length or required encryption algorithms.
- Procedures: Step-by-step instructions describing how to perform a task in compliance with standards, such as the procedure for granting system access to a new employee.
- Guidelines: Recommended but non-mandatory practices that offer flexibility.
- Baselines: Minimum security configurations for particular platforms or systems.

2.3 Common information security policies
An effective program typically includes policies covering:
- Information security governance and organization (roles, responsibilities, committees).
- Information classification and handling (public, internal, confidential, restricted).
- Access control and identity management (least privilege, need-to-know, segregation of duties).
- Acceptable use of technology resources.
- Password and authentication requirements.
- Remote access and mobile device usage.
- Data protection, privacy, and retention.
- Encryption and cryptographic key management.
- Change management and secure system development.
- Vulnerability and patch management.
- Incident response and breach notification.
- Business continuity and disaster recovery.
- Third-party and vendor security management.
- Physical and environmental security.
- Security awareness and training.
- Logging, monitoring, and audit trails.

2.4 Key frameworks and standards
CRMA candidates should recognize the major frameworks against which policies and practices are commonly evaluated:
- ISO/IEC 27001 and 27002: International standard for an Information Security Management System (ISMS) and the accompanying catalogue of controls.
- NIST Cybersecurity Framework: Organized around the functions Identify, Protect, Detect, Respond, Recover (with Govern added in version 2.0).
- COBIT: ISACA's governance and management framework for enterprise IT.
- COSO ERM and COSO Internal Control frameworks: Used to connect information security to broader enterprise risk management and internal control objectives.
- IIA Global Technology Audit Guides (GTAGs): Practical guidance for auditors on IT risks and controls.
- Sector-specific requirements such as PCI DSS for payment card data.

You do not need to memorize control numbers, but you should understand that these frameworks represent accepted criteria an auditor can use to evaluate the completeness and adequacy of an organization's policies.

Part 3: How Information Security Policies and Practices Work

3.1 Governance and accountability
Effective information security begins with governance. The board or an appropriate committee provides oversight. Senior management is accountable for the program. A Chief Information Security Officer (CISO) or equivalent role typically leads design and operation. Information owners (business managers) are responsible for classifying their data and approving access, while custodians (often IT) implement the technical protections. The Three Lines Model applies directly: operational management and IT are the first line, the information security and risk functions act as the second line, and internal audit provides independent assurance as the third line.

3.2 Risk-based approach
Policies should not be written in a vacuum. The process works as follows:
1. Identify information assets and classify them by sensitivity and criticality.
2. Identify threats and vulnerabilities relevant to those assets (external attackers, insiders, system failures, natural events, third parties).
3. Assess risk in terms of likelihood and impact, considering existing controls (inherent versus residual risk).
4. Determine risk responses: avoid, reduce (mitigate), share (transfer, including cyber insurance), or accept, in line with risk appetite and tolerance.
5. Design policies and controls that implement the chosen responses.
6. Implement the controls and communicate policies.
7. Monitor, measure, and report using key risk indicators (KRIs) and key performance indicators (KPIs).
8. Review and improve on a periodic basis and when significant changes occur (Plan-Do-Check-Act cycle).

3.3 Control types
Policies are operationalized through controls, which can be categorized in several ways that the exam may test:
- By function: Preventive (firewalls, access controls, encryption, training), Detective (intrusion detection, log review, reconciliations), Corrective (incident response, backups and restoration, patching).
- By nature: Administrative (policies, procedures, training, background checks), Technical or logical (authentication, access control lists, encryption), Physical (locks, badges, CCTV, environmental controls).
- Compensating controls: Alternative measures used when a primary control cannot be implemented.

3.4 Key practice areas
Access control operates on the principles of least privilege, need-to-know, and segregation of duties. Practices include formal provisioning and de-provisioning, periodic access recertification, privileged access management, and multi-factor authentication.

Data classification and handling ensures controls are proportionate to the value and sensitivity of information. A common failure found by auditors is a classification scheme that exists on paper but is not actually applied to data.

Security awareness and training addresses the human factor, which remains the most common attack vector through phishing and social engineering. Effective programs are ongoing, role-based, measured, and reinforced by management behavior.

Vulnerability and patch management provides a structured process for identifying, prioritizing, and remediating weaknesses within defined timeframes based on severity.

Incident response includes preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Policies should define escalation paths, roles, communication protocols, and regulatory notification obligations.

Third-party risk management recognizes that outsourcing a process does not outsource the risk. Practices include due diligence, contractual security clauses, right-to-audit provisions, review of independent assurance reports (such as SOC 2), and ongoing monitoring.

Business continuity and disaster recovery addresses the availability dimension, including backups, recovery time objectives (RTO), recovery point objectives (RPO), and regular testing.

Logging and monitoring supports detection and accountability. Logs must be protected from tampering, retained appropriately, and actually reviewed.

3.5 The policy lifecycle
A policy is only effective if it is managed through its lifecycle:
- Development: Based on risk assessment, legal requirements, and business needs, with input from stakeholders.
- Approval: By a level of authority commensurate with the policy's scope, typically senior management or the board for the top-level policy.
- Communication: Made accessible to all affected parties, with acknowledgment of receipt and understanding where appropriate.
- Implementation: Supported by standards, procedures, tools, and training.
- Enforcement: Consistent consequences for non-compliance; exception processes that are documented, approved, time-bound, and risk-assessed.
- Monitoring: Compliance measurement through self-assessments, automated tools, and audits.
- Review and update: At least annually and upon significant changes in technology, business, threats, or regulation.

Part 4: How the Assurance Professional Evaluates Information Security Policies and Practices

When evaluating the information security component of the risk management process, the CRMA professional focuses on both design adequacy (are the right policies and controls in place?) and operating effectiveness (do they actually work as intended?). Typical evaluation questions include:
- Is there a formally approved, current information security policy framework aligned with a recognized standard?
- Are roles and responsibilities, including ownership of information assets, clearly defined and understood?
- Is there a documented, periodic information security risk assessment, and do policies and controls trace back to identified risks?
- Are policies communicated, and is awareness training delivered and tracked?
- Are exceptions to policy documented, approved, risk-assessed, and periodically reviewed?
- Are controls tested, and are deficiencies tracked to remediation?
- Does management and the board receive meaningful, timely reporting on information security risk, incidents, and program performance?
- Is third-party security risk managed through the vendor lifecycle?
- Are incident response and business continuity plans tested and updated?
- Is the program reviewed and improved based on incidents, audit findings, and changes in the threat landscape?

Evidence used by the auditor includes policy documents and approval records, risk registers, training completion records, access review documentation, vulnerability scan results, incident logs, penetration test reports, management reports to the board, and interviews with key personnel. A critical assurance insight is that the existence of a policy is not evidence of its effectiveness; the auditor must test whether practices on the ground conform to the policy.

Part 5: Common Weaknesses the Exam Expects You to Recognize
- Policies that exist but are outdated, unapproved, or not communicated.
- Absence of a risk assessment linking controls to actual risks (controls chosen because they are available rather than because they address a risk).
- Security treated as solely an IT responsibility, with no business ownership of information.
- Lack of senior management or board oversight and reporting.
- Excessive or unreviewed user access, including dormant accounts and shared privileged credentials.
- Untested backup, recovery, and incident response plans.
- Undocumented or indefinite policy exceptions.
- Inadequate attention to third-party and cloud service provider risk.
- Awareness programs that are one-time events rather than ongoing.
- Monitoring that generates logs no one reviews.

Exam Tips: Answering Questions on Information Security Policies and Practices

Tip 1: Think governance first, technology second. The CRMA is a risk management assurance exam, not a technical certification. When a question asks about the most important element or the first step, the answer usually relates to governance, risk assessment, senior management commitment, or clear accountability rather than a specific technology such as a firewall or antivirus tool.

Tip 2: Know the policy hierarchy cold. Expect questions that distinguish policies (high-level intent, approved by senior management, stable), standards (mandatory specifics), procedures (step-by-step how), and guidelines (recommended, optional). If a question describes a document stating the minimum password length, that is a standard, not a policy.

Tip 3: Apply the CIA triad to scenario questions. When a scenario describes a risk, identify which attribute is threatened. Unauthorized disclosure is confidentiality; unauthorized modification is integrity; system outage or ransomware preventing access is availability. The most appropriate control will be the one that addresses that attribute.

Tip 4: Match risks to the right type of control. Be ready to classify controls as preventive, detective, or corrective, and as administrative, technical, or physical. Questions often ask for the best control to prevent a risk versus the best control to detect that it has occurred.

Tip 5: Remember that existence is not effectiveness. If a question states that an organization has a comprehensive information security policy and asks what the auditor should do next, the answer is to test whether the policy is communicated, implemented, and complied with, not to conclude that the risk is adequately managed.

Tip 6: Ownership of information belongs to the business. Questions about who should classify data or approve access are typically answered with the information owner (business management), not the IT department, which acts as custodian.

Tip 7: Apply the Three Lines Model. Internal audit does not design or operate security controls; it provides independent assurance. If an answer choice has internal audit writing the security policy or approving access requests, it compromises independence and is generally wrong.

Tip 8: Risk-based means proportionate. The best answer usually aligns the level of control with the classification and risk of the information. Applying the strictest controls to everything is inefficient; applying uniform weak controls is inadequate. Look for the option that ties controls to risk assessment and risk appetite.

Tip 9: Outsourcing does not transfer accountability. In questions involving cloud providers or vendors, the organization remains accountable for protecting its information. Look for answers involving due diligence, contractual requirements, independent assurance reports, and ongoing monitoring.

Tip 10: Exceptions must be managed, not ignored. If a question involves a business unit that cannot comply with a policy, the best answer involves a documented, approved, time-limited exception with compensating controls and risk acceptance by an appropriate authority, not simply ignoring the policy or granting an informal waiver.

Tip 11: Watch for absolute language. Answer choices containing words like always, never, all, or eliminate are frequently incorrect because risk can be reduced but rarely eliminated. The exam favors answers that reduce risk to an acceptable level consistent with risk appetite.

Tip 12: Identify the BEST or MOST appropriate answer. Several options may be partially correct. Eliminate those that are technically narrow, that address a symptom rather than the root cause, or that skip a logical step such as risk assessment before control selection. The best answer is typically the most comprehensive, risk-based, and governance-oriented option.

Tip 13: Link to the continuous improvement cycle. Questions about what should happen after an incident, audit finding, or significant change usually point toward updating the risk assessment and policies, retraining, and reporting to governance bodies, reflecting the Plan-Do-Check-Act approach.

Tip 14: Use recognized frameworks as criteria, not as answers in themselves. If asked how an auditor should evaluate the completeness of a policy set, the answer involves comparing against a recognized framework such as ISO 27001 or the NIST Cybersecurity Framework. However, adopting a framework is not itself a control; the organization must implement and operate it.

Summary
Information security policies and practices are the organizational expression of how an entity intends to protect the confidentiality, integrity, and availability of its information in line with its risk appetite. They are built on governance and accountability, informed by risk assessment, structured through a hierarchy of policies, standards, and procedures, implemented through layered controls, and sustained through monitoring and continuous improvement. For the CRMA exam, your task is to evaluate these elements as an assurance professional: ask whether the design is adequate, whether operation is effective, whether accountability is clear, and whether management and the board receive the information they need to oversee the risk. Approach every question with a governance-first, risk-based, evidence-driven mindset and you will handle this topic with confidence.