Chapter 5 of 13 · Weeks 2–4
Writing a Policy People Actually Read
- Why does nobody read our policies?
- How long should a policy be?
- What is the difference between a policy, a standard and a procedure?
Most security policies fail for the same reason: they try to do everything. They mix intent, rules and step-by-step instructions, so they are long, out of date within months, and read only during audits.
Three documents, three jobs
| Document | Answers | Changes |
|---|---|---|
| Policy | What we have decided and why | Rarely; approved by leadership |
| Standard | The specific rules that follow, such as password length | Sometimes; owned by security |
| Procedure | Step by step, how a team does it | Often; owned by the team doing it |
How to write one
- Start from the decision. What must people do or not do? Write it as a short rule.
- Say who it applies to and who owns it.
- Say what happens when someone needs an exception, and who can approve it.
- Remove anything a team will change next month. Move it to a procedure.
- Read it aloud to someone it applies to. Fix every sentence they ask about.
- Set a review date and put it in a calendar, not only in the document.
Use short sentences and plain words. "Staff must lock their screen when they leave their desk" beats "Personnel shall ensure that endpoint devices are secured against unauthorised access when unattended." Both say the same thing. Only one gets read.
The question you might not ask out loud
Our policies were written by a consultant and approved years ago. Can I change them?
Yes, through the approval process your governance sets out. Start with the policy that most often causes confusion or exceptions. Show the owner a side-by-side: the old text, the new text, and what changes in practice.
Rule of thumb:If a policy says something nobody does, you have two honest options: change the practice or change the policy. Leaving the gap is how controls end up existing only on paper.
Policy sprawl
Every incident tempts someone to write a new policy. Resist it. Ask first whether an existing policy already covers it and simply needs a clearer rule. Fewer, shorter documents that are actually followed are worth more than a large library nobody opens.
Keep a register of every controlled document: name, owner, version, approval date and review date. Auditors will ask for it, and it is the simplest way to find documents that have quietly gone stale.