I’ve seen policies from lots of companies big and small. Generally, I’m a techie engineer so I don’t love policy. I’ve also seen a fair number of companies that clearly don’t follow their policy. I’ve also seen companies that get certifications like SOC2 and ISO that are meaningless because they systematically lie and their auditors (not us, we don’t do auditing) never check lots of basic things we see. Sometimes the security teams at the companies aren’t lying, they just don’t even know the truth about their own company. I get it, there’s all kinds of reasons we can’t always have nice things.
In response to that, we spent a few years at Jemurai trying to write minimal policies that people could understand and follow. I even published a blog post last summer about it and we tried selling a minimal policy bundle off of our website. It seemed like a good idea at the time. I think the philosophy was generally sound in a pure sense.
The problem is, people use policy as a defense against auditors and without more explicit direction, you can’t say you have controls around a variety of things. You don’t even know you need to know the answer to questions about data loss protection or mobile devices in your network. Inevitably, sooner or later someone is going to run up against a SIG Lite or a more exhaustive partner checklist or some trigger that forces them to articulate a more complicated policy.
To update our position on this, while staying arms length from auditing and full on policy work in the future, we developed policies in Markdown and published them to our private Github repo. They look nice and everybody can immediately see what the policies are and who changed them when. We can also track approvals using pull requests. For smaller tech companies this makes for a simple more digestible way to get, use and publish policy. It keeps it in a relevant and accessible place. We can share it with their security point of contact by letting them fork our policy in Github. They can subscribe to updates and merge our new best practices in as they evolve. So far, this seems to be a good direction.