During my experience as an assessor, auditor, practitioner and consultant, I find that documentation is a real pain for organisations. Too often I see organisations who have ended up with documentation that is inappropriate for the way they work. Large, bulky manuals full of technical information. Documents that are inconsistent and in different formats and layouts. Documents are written for an external assessor rather than for the a practical business process. The result is clear. People don’t bother to read or use them. And this means the resulting business practices become non compliant and out of control. Security risks therefore, will increase dramatically.
Getting documents “write” shouldn’t be difficult. I’ve compiled a list of top tips below that, if followed, should ensure that documentation stays, relevant, up to date, useable and more importantly read and followed by an organisations stakeholders.
The most important document you will write is the document control, or “how to document” document. This will set out the formats and practices that the rest are built on, and makes sure that all the other documents are consistent within the organisation.
Educate staff on the difference between policy (senior management aspiration), procedure (documenting how to undertake a process), guidance (non-mandatory help or explanation) and records (evidence that procedures have been carried out). Too many organisation use the word “policy” to mean all of the above and end up with documentation with very confused purposes and language.
Try to keep documents short and succinct. As a guide, try and keep policies to a single page, procedures to around three. Consider whether a picture or diagram will be more effective than words.
Allocate roles and responsibilities early to ensure everyone knows where they stand. If you allocate someone a role or responsibility, be clear what that entails and requires of the individual.
Give staff ownership of documents that pertain to their part of the business. Make them responsible for document update and maintenance. Not only will it ensure that documents are produced, but that they are relevant, accurate and practical to their right audience. Audit to ensure documents have been reviewed and updated.
Try and avoid large and unwieldy compliance manuals, instead build security controls in to the smaller business process documents that are relevant to the staff who will use them.
When pursuing standards, though you must ensure the requirements are covered, ensure that documents are still written in language that is appropriate to the staff and culture of the business. For example, if a standard says you must have a “corrective action” procedure, it may be better to call it something like “How do we fix problems?” instead of the title from the standard.
When applying protective marking (or information classification) to documents, make sure that everyone is educated in the marking system and what it means you can and cannot do with a document. Consider extending the marking system to other tangible information assets, such as manual files, emails, media and using it for the basis of access control (ie this is a “public” zone and through that door is the “confidential” zone)
Consider how you will evidence that staff have read and understood documents. However, getting staff to sign loads of documents can sometimes be a waste of resource. Consider standing orders that require staff to visit a folder or intranet page at a certain time, or an email with links to relevant documents.
Don’t mix words like “will”, “shall” and “should” in the same document. Some words are aspirational (“will” is a good word for policy), some are mandatory (“shall” or “must” is good for procedures) and some are non-mandatory (“should” or “may” is good for guidance). Mixing these words like this within a single document means that you are not providing clear direction to your staff on what they are required to do. Being consistent in your words means that the style of documents and instructions to staff remain consistent.
Make sure document formats and templates are held centrally and used by staff to create documents. This ensures the logo and brand is protected, and staff have examples to work from. Make sure that documents can be approved and published centrally to ensure that all documents contain the relevant information and can be found when required (technology solutions for storing these documents in web portals are becoming more popular by the day).
Finally – whenever I train staff and information security professionals the documentation part of the courses, is always initially met with a groan. However, once people see the many benefits of good documentation regimes, they leave the session enthused and confident, knowing the many benefits that good communication can brings to any organisation, and the improvement it can bring to its security stance.
Post by Ralph O’Brien.
Follow us on Twitter
Join us on Facebook
RSS Feed
