The devil is in the details: The importance of tight processes to strong information security

Have you ever pulled a policy or procedure down from the internet, changed a few things and called it your own? If not, you are probably one of a small minority. Most of us have done this from time to time, and building on the work of another (assuming of course that it is not copyrighted) is a good way to start, as long as you make the proper adjustments to meet your specific needs.

Therein, however, lies the problem.

The issue of useless policies and procedures often begins with an audit finding about the lack of such documentation, sending folks scrambling to get something in place. Many organizations, particularly smaller ones, have no experience with writing policies, so they figure that something is better than nothing.

Policies, procedures and guidelines together form the processes that make an organization function. Good processes help to ensure that you are ready to address occurring problems quickly and consistently, which is particularly important when addressing information security issues.

Read more at Computerworld