Structure and Challenges of a Security Policy on Small and Medium Enterprises

Abstract

Information Technology (IT) plays an increasingly important role for small and medium-sized enterprises. It has become fundamental for these companies to protect information and IT assets in relation to risks and threats that have grown in recent years. This study aims to understand the importance and structure of an information security policy, using a quantitative study that intends to identify the most important and least relevant elements of an information security policy document. The findings of this study reveal that the top three most important elements in the structure of a security policy are the asset management, security risk management and define the scope of the policy. On the other side, the three least relevant elements include the executive summary, contacts and manual inspection. Additionally, the study reveals that the importance given to each element of the security policy is slightly changed according to the sectors of activity. The elements that show the greatest variability are the review process, executive summary and penalties. On the other side, the purpose of the policy and the asset management present a stable importance for all sectors of activity.

Integrated Information Security Policy Model for Saudi Arabia Organizations

“…It consists of three main phases of security policy development, namely the pre-development, development, and implementation phases. Almeida et al (2018) the authors discovered that the top three most important elements in the structure of a security policy are asset management, security risk management, and defining the scope of the policy. However, the security strategies controls did not cover by the study.…”