OnSite

This course is the most in-depth coverage of information security policy ever developed. By the end of the course your head will be spinning. During this intensive two-day security-policy course, you will learn what security policy is (positive and negative tone); How to create consistent policies; how to balance the level of specificity to the problem at hand; the role of policy, awareness and training; the SMART approach to security policy development and assessment.

Author Statement

Author Statement

I have been told, "do this according to your security policy," or "you should have this in your security policy" so many times, but no one ever said how to create a policy. In 1997, an instructor in a class I was taking said that and I remember thinking, "alrighty then, I am going to figure this out." As a result, I started a research project with SANS and a colleague, John Ritter, to determine the steps to consistently develop good, and the right, policy and then get it approved. We do not claim to have all the answers, but this is the most comprehensive security policy training available. A lot of material can be found on the web if you are skilled at targeted Google searches, but I have been researching, improving, and adding to the material for a long time, and frankly time is money. In two course days, the diligent student will become an expert on information security policy.

- Stephen Northcutt