--- title: Cybersecurity Policies description: This subject covers the frameworks, guidelines, and procedures used to protect an organization's digital assets. Learners will understand how to draft, implement, and audit security policies that comply with industry standards and regulatory requirements. category: programming-tech subcategory: cybersecurity difficulty: beginner, intermediate, advanced url: /subject/cybersecurity-policies --- # Cybersecurity Policies This subject covers the frameworks, guidelines, and procedures used to protect an organization's digital assets. Learners will understand how to draft, implement, and audit security policies that comply with industry standards and regulatory requirements. ## Available Resources 2 Books • 7 Websites ## Websites ### 1. SANS Institute Free Resources Library of free, customizable information security policy templates maintained by SANS with the Cybersecurity Risk Foundation, spanning acceptable use, passwords, encryption, email and incident response. Gives a starting draft rather than a finished policy. **Difficulty:** Beginner | **Price:** Free **Link:** https://www.sans.org/information-security-policy/ **Tags:** security-policy, information-security, governance, policy-templates, compliance ### 2. ISO 27001 Official Site ISO catalogue entry for ISO/IEC 27001:2022, the certifiable standard for information security management systems. Sets out risk assessment and treatment requirements plus the 93 Annex A controls; the abstract and scope are readable free. **Difficulty:** Beginner | **Price:** Free **Link:** https://www.iso.org/standard/82875.html **Tags:** iso-27001, isms, information-security, standards, compliance ### 3. CIS Critical Security Controls Center for Internet Security's prioritized set of defensive safeguards, grouped into implementation groups so smaller organizations know which controls to adopt first. Free download, with mappings to NIST CSF, ISO 27001 and other frameworks. **Difficulty:** Beginner | **Price:** Free **Link:** https://www.cisecurity.org/controls **Tags:** cis-controls, cybersecurity, security-frameworks, risk-management, compliance ### 4. NIST SP 800-53 Revision 5 of the federal catalog of security and privacy controls, organized into twenty families spanning access control, incident response, supply chain and more. Practitioners use it to select, tailor and document the safeguards a system or organization must implement. **Difficulty:** Beginner | **Price:** Free **Link:** https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final **Tags:** security-controls, compliance, risk-management, nist, information-security ### 5. Schneier on Security **Author:** Bruce Schneier Long-running blog and essay archive of security technologist Bruce Schneier, covering cryptography, surveillance, privacy, security economics and technology policy. Readers follow expert analysis of current breaches and legislation and develop a critical view of how security decisions are made in practice. **Difficulty:** Intermediate | **Language:** English | **Price:** Free **Link:** https://schneier.com **Tags:** security-policy, privacy, surveillance, cryptography, security-commentary ### 6. cisa.gov Official site of the U.S. Cybersecurity and Infrastructure Security Agency, providing guidance, alerts, and resources to protect networks and critical infrastructure. It offers cyber threat advisories, best practices, risk management frameworks, incident response guidance, and programs addressing ransomware and infrastructure security. **Difficulty:** Intermediate | **Language:** English | **Price:** Free **Link:** https://cisa.gov **Tags:** websites, technology-computer-science, technical-skills ### 7. sans.org Sans.org is the official site of the SANS Institute, a leading provider of cybersecurity training and certification. It offers training courses, GIAC certifications, security research, white papers, and various resources for security professionals. **Difficulty:** Intermediate | **Language:** English | **Price:** Free **Link:** https://sans.org **Tags:** websites, technology-computer-science, cybersecurity ## Podcasts ### 1. The Cyberlaw Podcast **Author:** Stewart Baker Weekly interview and roundup podcast hosted by former NSA general counsel Stewart Baker. Episodes debate current developments in cybersecurity regulation, surveillance, privacy law, AI governance and national security, helping listeners follow how technology policy is argued and made. **Difficulty:** Intermediate | **Language:** en | **Price:** Free **Link:** https://podcasts.apple.com/podcast/id836535581 **Tags:** cybersecurity-law, privacy-law, technology-policy, national-security, surveillance ## Books ### 1. Information Security Governance **Author:** Krag Brotby Brotby sets out how to build a security program that answers to business objectives rather than to IT, covering strategy development, governance structures, roles, policy hierarchies and metrics. Aimed at managers defining an organization's security posture rather than at engineers. **Difficulty:** Intermediate | **Language:** English | **Price:** Paid **Link:** https://www.amazon.com/dp/0470131187?tag=edmonddante07-20 **Tags:** books, technology-computer-science, technical-skills ### 2. Managing Cybersecurity Risk **Author:** Jonathan Reuvid An edited collection of practitioner chapters and case studies aimed at directors and senior managers of small and mid-sized firms who have not yet treated cyber risk seriously. Frames security as a board-level governance duty rather than a technical one. **Difficulty:** Intermediate | **Language:** English | **Price:** Paid **Link:** https://www.amazon.com/dp/178719891X?tag=edmonddante07-20 **Tags:** books, technology-computer-science, technical-skills --- *This content is part of Dantes.io - Your Treasure Map to Knowledge* *Curated by humans at Dantes.io. Personal study use welcome; republishing this curation requires permission (team@dantes.io).* View this page online: https://dantes.io/subject/cybersecurity-policies