Appendix C: Guidelines
This appendix provides comprehensive implementation guidelines and policies that support the Information Security Policy framework.
Guidelines Framework
The following guidelines provide detailed requirements for implementing security controls across the organization:
Subsections
To ensure encryption technologies used across the organization are secure, interoperable, and compliant with internation...
To protect users and the organization from digital risks and legal exposure due to misuse of IT systems, devices, and da...
To ensure that users only have access to the systems and data they need, based on their role, and that all access is aut...
To enable responsible, ethical, and secure use of AI within the organization. This includes internal business operations...
To establish full visibility and control over all IT assets — including hardware, software, and data systems — in order...
To ensure that all cloud services used by the organization meet strict cybersecurity, data protection, and operational s...
To maintain secure, consistent, and documented configurations across all IT assets to reduce risks such as unauthorized...
To identify, classify, and track all organizational data in a way that supports data protection, regulatory compliance,...
To ensure database credentials are securely stored, retrieved, and isolated from program logic — minimizing the risk of...
To foster a security-aware culture by ensuring everyone understands their cybersecurity responsibilities and can recogni...
To ensure all organizational email communication is protected from spam, malware, phishing, and data leakage — reducing...
To ensure user identities are securely created, managed, and terminated — with proper authentication and access controls...