Security Architecture Policy
A security architecture policy is a formal statement of the rules that govern an organization’s security architecture and the roles that have access and responsibility in maintaining its information and technology.
These policies aren’t one-size-fits-all and are most effective when they’re custom-tailored for each organization. Security architecture policy comes from assessing the entire environment to determine applicable risks and vulnerabilities as well as what countermeasures should be taken in order to mitigate and contain these risks.
Endorsing and enforcing security architecture policy is essential, starting at the top of the organization and moving down through every person who interacts with the environment. This includes non-employees, as well as those who work for the organization. In order to help everyone adhere to the policies that have been put forth, the security architecture team will develop a set of security architecture standards.
Security Architecture Standards
If security architecture policy describes what needs to happen, then security architecture standards explain how it will happen. Security architecture standards are based on the policy statements and they lay out a set of requirements that show how the organization implements these policies. The standards help create mechanisms by which the policies are enacted in order to avoid risks, identify threats, and take action in the event of an incident.
These policies and standards apply to different areas of the security program that stretch out across the entire organization. To help organize and manage them, they're laid out as a series of processes that come together to make up a comprehensive enterprise security architecture program.