23
votes

My company is working with another company and as part of the contract they are requesting a copy of my company's written IT Security Policy. I don't have a written IT security policy, and I'm not exactly sure what I want to give to them. We're a Microsoft shop. We have update schedules, limited accesses accounts to manage servers, firewalls, ssl certificates and we run the Microsoft Baseline Security Analyzer from time to time.

We configure services and user accounts as we feel is mostly safe and secure (it's tough when you don't have full control over what what software you run), but I can't go into every detail, each service and server is different. I'm getting more information about what they want but I feel as if they're on a fishing expedition.

My questions are, Is this a standard practice to ask for this information? (I'm not against it honestly, but it's never happened before.) And if this is standard, is there a standard format and expected level of detail I should present?

2
  • 1
    Turns out we're applying for c-tpat certification. We are only required to adhere to two things. 1) Password Protection 2) Accountability ( cbp.gov/xp/cgov/trade/cargo_security/ctpat/security_guideline/… ) The amazing amount of good answers here have got me thinking though, I've started a project to have a formal plan using a lot of your advice, not for certification but for ourselves.
    – reconbot
    Jun 9, 2009 at 20:07
  • This question is off-topic under current topicality rules. Jan 22, 2015 at 3:23

9 Answers 9

44
votes

They don't need a copy of your entire internal IT policy but I think they may be after something similar to this - someone definitely needs to get you enough information about the contract to determine how much detail you need to provide, and about what. Tho I agree with Joseph - if they need the information for legal/compliance reasons, there needs to be legal input.

Background Information

1) Are any of your employees located outside of the US?

2) Does your company have formalized and documented information security policies in place?

3) Is the handling and classification of information and data covered by your information security policies?

4) Are there any outstanding regulatory issues that you are currently addressing in the state(s) you operate in? If yes, please explain.

General Security

1) Do you have an information security awareness training program for employees and contractors?

2) Which of the following methods for authenticating and authorizing access to your systems and applications do you currently use:

  • Performed by operating system
  • Performed by commercial product
  • Single sign-on
  • Client-side digital certificates
  • Other two-factor authentication
  • Home grown
  • No authentication mechanism in place

3) Who authorizes access for employees, contractors, temps, vendors, and business partners?

4) Do you allow your employees (including contractors, temps, vendors, etc.) to have remote access to your networks?

5) Do you have an information security incident response plan? If no, how are information security incidents handled?

6) Do you have a policy that addresses the handling of internal or confidential information in e-mail messages to outside your company?

7) Do you review your information security policies and standards at least annually?

8) What methods and physical controls are in place to prevent unauthorized access to your company's secure areas?

  • Network servers in locked rooms
  • Physical access to servers limited by security identification (access cards, biometrics, etc.)
  • Video monitoring
  • Sign-in logs and procedures
  • Security badges or ID cards visible at all times in secure areas
  • Security guards
  • None
  • Other, Please provide additional details

9) Please describe your password policy for all environments? I.e.. Length, strength and aging

10) Do you have a disaster recovery (DR) plan? If yes, how often do you test it?

11) Do you have a Business Continuity (BC) plan? If yes, how often do you test it?

12) Will you provide us a copy of your tests results (BC and DR) if requested?

Architecture and system review

1) Will [The Company]’s data and/or applications be stored and/or processed on a dedicated or shared server?

2) If on a shared server, how will [The Company]’s data be segmented from other companies’ data?

3) What type(s) of company-to-company connectivity will be provided?

  • Internet
  • Private/Leased line (e.g., T1)
  • Dial-up
  • VPN (Virtual Private Network)
  • Terminal Service
  • None
  • Other, Please provide additional details

4) Will this network connectivity be encrypted? If yes, what method(s) of encryption will be used?

5) Is there any client-side code (including ActiveX or Java code) required in order to utilize the solution? If yes, please describe.

6) Do you have a firewall(s) to control external network access to your web server(s). If no, where is this server(s) located?

7) Does your network include a DMZ for Internet access to applications? If no, where are these applications located?

8) Does your organization take steps to ensure against Denial-of-Service outages? Please describe these steps

9) Do you perform any of the following information security reviews/tests

  • Internal system/network scans
  • Internally managed self assessments and/or due diligence reviews
  • Internal code reviews/peer reviews
  • External 3rd party penetration tests/studies
  • Other, Please provide details How frequently are these tests performed?

10) Which of the following information security practices are being actively used within your organization

  • Access control lists
  • Digital certificates - Server Side
  • Digital certificates - Client Side
  • Digital signatures
  • Network based intrusion detection/prevention
  • Host Based intrusion detection/prevention
  • Scheduled updates to intrusion detection/prevention signature files
  • Intrusion monitoring 24x7
  • Continuous virus scanning
  • Scheduled updates to virus signature files
  • Penetration studies and/or tests
  • None

11) Do you have standards for hardening or securing your operating systems?

12) Do you have a schedule for applying updates and hot fixes to your operating systems? If no, please tell us how you determine what and when to apply patches and critical updates

13) To provide protection from a power or network failure, do you maintain fully redundant systems for your key transactional systems?

Web Server (if applicable)

1) What is the URL that will be used to access the application/data?

2) What operating system(s) is the web server (s)? (Please provide OS name, version and service pack or patch level.)

3) What is the web server software?

Application Server (if applicable)

1) What operating system(s) is the application server (s)? (Please provide OS name, version and service pack or patch level.)

2) What is the application server software?

3) Are you using role based access control? If yes, how are the access levels assigned to roles?

4) How do you ensure that appropriate authorization and segregation of duties are in place?

5) Does your application employ multi-level user access / security? If yes, please provide details.

6) Are activities in your application monitored by a third party system or service? If yes please provide us with the company and service name and what information is being monitored

Database Server (if applicable)

1) What operating system(s) is the database server (s)? (Please provide OS name, version and service pack or patch level.)

2) Which databases server software is being utilized?

3) Is the DB replicated?

4) Is the DB server part of a cluster?

5) What is done (if anything) to isolate [The Company]’s data from other companies?

6) Will [The Company]’s data, when stored on disk, be encrypted? If yes, please describe encryption method

7) How is source data captured?

8) How are data integrity errors handled?

Auditing and Logging

1) Do you log customer access on:

  • The web server?
  • The application server?
  • The database server?

2) Are the logs reviewed? If yes, please explain the process and how often are they reviewed?

3) Do you provide systems and resources to maintain and monitor audit logs and transaction logs? If yes, what logs do you retain and how long do you store them?

4) Will you allow [The Company] to review your system logs as they pertain to our company?

Privacy

1) What are the processes and procedures used to declassify/delete/discard [The Company]’s data when no longer needed?

2) Have you at any time erroneously or accidentally disclosed customer information?
If yes, what corrective measures have you implemented since?

3) Do contractors (non-employees) have access to sensitive or confidential information? If yes, have they signed a non-disclosure agreement?

4) Do you have vendors that are authorized to access and maintain your networks, systems, or applications? If yes, are these vendors under written contracts providing for confidentiality, background checks, and insurance/indemnification against loss?

5) How is your data classified and secured?

Operations

1) What is the frequency and level of your back-ups?

2) What is the onsite retention period of back-ups?

3) What format are your backups stored in?

4) Do you store backups at an off-site location? If yes, what is the retention period?

5) Do you encrypt your data backups?

6) How do you ensure that only valid production programs are executed?

3
  • Kara this is one of the most well thought out and detailed responses I've even gotten. I'm guessing you've done this a few times.
    – reconbot
    Jun 9, 2009 at 17:44
  • 1
    I'm used to filling them out, yes. ;) I suspect they're put together by vast committees in dark, smoke-filled rooms... I'm glad it helps, tho. The quandry you were handed is a huge reason for SF to exist. Jun 9, 2009 at 18:05
  • 1
    "Are any of your employees located outside of the US?" -- funny. From my point of view it's more a risk to have an employee located in the US. The point being that we are bound by law to not let anyone access the data or servers (without approval by a judge) and our lawyers said that exactly this requirement can't be met if some employee from the US has access to this data :) Jul 4, 2011 at 22:33
4
votes

I've only ever been asked for this information when working with regulated industries (banking) or government.

I'm not aware of a "standard format", per se, but then I've always been given some template that my Customer was given by an auditor as a "starting place" when I've had to make these.

I'd probably start with some Google searches and see what I could find in the way of sample policy documents. SANS (http://www.sans.org) is also another good place to start looking.

As far as the level of detail goes, I'd say that it probably needs to be tailored to the audience and the purpose. I'd keep the detail high-level unless I was specifically asked to provide low-level details.

1
  • I used to always use an NIST template to quickly create a security policy, but I don't have a copy anymore and a quick google can't find the originals anymore (I think NIST now charges). The government of California has some good resources, including templates, at oispp.ca.gov/government/Library/samples.asp the above suggestion of the SANS Institute is a great resource too.
    – hromanko
    Jun 9, 2009 at 15:32
4
votes

There are several different reasons a company may want to see your security policy. One example is that the Payment Card Industry (Visa, MasterCard, AmEx, etc...) requires the companies that process credit cards must adhere to Payment Card Industry - Data Security Standard (PCI-DSS). A section of the PCI-DSS requires that the partners of the company must also adhere to PCI-DSS (which of course requires written policies).

Frankly if I am granting you access to your network via a VPN or direct connection, then I want to know that you have a certain level of security, otherwise I am opening myself to all sorts of potential issues.

That's why being PCI or ISO 27001 certified can be a boon in this regards because you can let the external organization know that you have things handled up to a certain level. If your policies are very general which policies should be, then it might not be an issue to provide a copy to your partner. However if they want to see specific procedures or security information then I wouldn't let that leave my site.

Kara has some excellent guidance on what you want to cover in your policies. Here's an example of a policy.

IT-001 System Backup/Recovery Policy

I. Introduction This section talks about how backups are important, how you plan to test and keep copies offsite.

II. Purpose A. This policy will cover frequency, storage, and recovery B. This policy covers data, operating systems, and app software C. All backup/recovery procedures must be documented and kept in a safe place

III. Scope This section notes that the policy covers all of the servers and data assets in your company (and any other specific areas like satellite offices).

IV. Roles and Responsibilities A. Manager - decides what gets backed up, determines frequency, medium, and procedures, also checks that backups happen B. System Admin - Runs the backups, checks the backups, tests the backups, transports backups, tests restoration, maintains the backup rotation grandfather/father/son C. Users - Has input on what gets backed up, must place data in location designated to be backed up

V. Policy Description Backup - all the stuff you want to say about backups in a general sense Recovery - all the stuff you want to say about recovery in a general sense

Specific step by step instructions should be in a separate procedures/work instruction document. However if you have a very small organization, you might not separate policies from procedures.

I hope this helps and gives you some useful information.

1
  • +1 because I would be willing to bet on the fact it is a contract that PCI may be involved. (the credit card PCI, not the old bus connector). if this is the case, they don't want a full spec, just the things that effect their PCI compliance.
    – Matt
    Jun 9, 2009 at 16:49
1
vote

I had to write one of these recently and it didn't end up being too difficult. Granted, Even's point about tailoring is important though, as some details are going to take more work to describe than others. NIST also has a large library of free, online publications describing security measures for various purposes, you can use these for ideas where you're not sure what type/extent of security is called for.

Here's some general categories to cover in high level terms though:

  • Data Retention Policy
  • Backup Procedures/Access to backups
  • In-house access restrictions(physical and virtual)
    • Network (wireless, wired)
    • Hardware (servers, workstations, office premises, off-site/telework)
    • Hosting/Data Center (important if you're storing the partners data)
    • Operating System
  • Personnel Screening

This list can be expanded or reduced based on now much information is necessary. Also, no need to fret if you don't yet have quite have all of this in place. My advice is to stick to describing your 'intended' policies, but be prepared to immediately expand them for anything lacking. Also be prepared to be called on what you're claiming, no matter how unlikely this is (the lawyers won't care later on).

1
vote

I would get with your company's legal counsel on this to start with especially since it is part of a contract.

1
vote

To address the need you have to send a copy of your security policy doc would be a little against security. I have written our security policy and have pulled the majority of the Docs from the SAN's Templates. The others you can fill in with specific policy searches on Google. The way we handle an outside party wanting to see the policy is letting them sit down in our Director of Operation's office and allowing them to read it. Our policy is that the policy never leaves the building and more specifically our sight. We do have agreements that any 3rd party has to agree to when working in specific capacities that would require access to our information. And they are on a case by case basis. This policy may not fit your environment nor will all the policies that are on SAN's website pertain to you or your business but I would recommend beginning the process of building your security policy and once approved by Upper management begin to enforce it.

2
  • Glad I'm not the only one with this experience.
    – MathewC
    Jun 9, 2009 at 18:57
  • It has been interesting, but a great experience. My users might not like me very much any more but if you look at it from a statistical perspective. I read in eweek or informationweek that somewhere in the neighborhood of 70% of all companies who experience a security breach fail to recover and within 2 years of finding the breach close their doors.
    – TechGuyTJ
    Jun 9, 2009 at 19:54
1
vote

Is it standard practice: my experience is yes for certain industries that are regulated, such as banking, food, energy, etc.

Is there a standard format: there are a number of standards, but if your contract doesn't specify a standard (ISO, for example) then you should contractually OK to provide whatever format you choose.

It shouldn't be difficult. You already have a patching and password standard, so the document should specify what that standard is and how your ensure that it is followed. Don't fall into the trap of spending too much time making it pretty. Just a simple document will suffice.

If your contract specifies using a specific standard then you should seek professional help to ensure that you are contractually compliant.

1
vote

We get this question a lot because we are a hosting facility. Bottom line is that we don't give it out unless we know exactly what they're looking for in advance. If they're looking for something in our security policy that we don't have, it's typically because the nature of our business doesn't require it, and we tell them so. That can be subjective, but it doesn't matter - we have yet to lose any business because of it. More often than not, they are asking because they have to tell someone else that they did. A 'NO' answer is not necessarily a bad thing or a deal breaker.

We just went through SAS70 II certification, so now we just give the auditor's opinion letter and let that speak for our written policies.

0
votes

You'll need an NDA before you show them anything. Then I would let them come and review the security policy, but never have a copy of it.

8
  • I wouldn't have voted you down, but while I wouldn't publish it, sharing it with business partners is not out of the question. While it hasn't been the same at every company I've worked at, my IT department exists for the business needs above any other. I imagine sharing our IT Security plan is akin to sharing a business process or business plan.
    – reconbot
    Jun 9, 2009 at 17:43
  • I've gone through SAS70 compliance and many "partners" would only allow review. It's a liability to have something in print that says you do something, and then you don't, or you did something that caused a problem. I'm sorry you don't agree, but I was giving my opinion from experience. I don't think that deserves a downvote.
    – MathewC
    Jun 9, 2009 at 18:43
  • Just being clear I didn't down vote you. There was no need for that. You're experience is exactly the kind of thing I liked to hear about. Thanks!
    – reconbot
    Jun 9, 2009 at 20:09
  • If I had the rep, I would vote you down. They do not need to sign a NDA just to see your IT Security Policy / InfoSec Policy. (There is a distinction between a policy and a standard/procedure) There are plenty of valid reasons for needing to see an orgs InfoSec Policy (Sox compliance, PCI DSS, etc.) Most orgs make it completely public: obfs.uillinois.edu/manual/central_p/sec19-5.html Jun 10, 2009 at 13:43
  • It's a precaution. If you don't want to take it to protect yourself, then it's on you. I gave a valid reason why you shouldn't do it. And I'm sorry you don't have the rep to vote me down. I like to reserve my down votes for bad/dangerous answers, not policy I don't agree with.
    – MathewC
    Jun 10, 2009 at 14:09

Not the answer you're looking for? Browse other questions tagged .