Creating, Approving, and Reviewing Security Documents

Document management communicates approved rules and checks execution and improvement, as well as maintaining current versions. Define ownership, approvals, effective dates, training, evidence, and review triggers from the outset.

From drafting to operation

Stage	Activity	Output or completion condition
1. Understand context and requirements	Review business, assets, incidents, existing documents, laws, contracts	Scope, applicable requirements, gaps
2. Prioritize risks	Assess impact/likelihood and assign treatment owners	Risk register, treatment plan
3. Design the documentation system	Allocate content to policy, rules, standards, procedures; remove duplication	Document inventory and relationships
4. Draft and review	Operations, IT, HR, legal, and other relevant functions check feasibility and consistency	Draft, review results, open questions
5. Approve and prepare	Follow delegated authority; prepare configuration, education, transition	Approval record, effective date, migration plan
6. Communicate and operate	Explain changes and tasks to affected people; execute procedures	Communication, training, operational records
7. Review performance	Evaluate gaps, exceptions, incidents, and audit findings	Corrective plan, leadership decisions, review records
8. Revise or withdraw	Update related documents/configurations and manage old versions	Revision history, archived versions, updated references

The requirements register should include applicability rationale, activities affected, corresponding clauses/evidence, owner, and review date. Assess external guidance’s scope and implementation before making it an internal obligation.

Document control fields

Document ID: IS-STD-001
Title: Access Management Standard
Version: 2.0
Status: Approved, awaiting effective date
Owner: Security lead
Approver: Authority designated in decision-making rules
Approval / effective date: YYYY-MM-DD / YYYY-MM-DD
Scope: Customer information services and privileged accounts
Disclosure: Internal only
Higher-level authority: Information Security Management Rules
Related documents: Account creation/removal and access review procedures
Authoritative copy: Document management system location
Next review: YYYY-MM-DD
Change: Expanded MFA scope and additional evidence verification

Do not rely only on a date in the filename to identify the active version. Distinguish draft, approved, awaiting effect, active, and withdrawn states. Direct users to the active authoritative copy and retain clearly identified old versions for historical checks.

Approval and communication

Define who approves policies, rules, standards, and procedures under delegated authority. Significant scope changes or increased risk may require a higher-level decision than routine procedural revisions.

Communication involves explaining who is affected and what changes. Expanding MFA scope requires enrollment instructions, support contacts, administrative configuration, handling of unenrolled users, and arrangements for systems that will be nonconforming on the effective date. Exercise important procedures and communicate necessary supplier changes through agreed contractual processes.

Periodic and event-driven reviews

Trigger	Review question
Scheduled review	Are scope, owners, requirements, and operational outcomes still appropriate?
New business, cloud, AI, or location	Are information scope, responsibility, controls, and approval conditions sufficient?
Changes to laws, contracts, or external guidance	Which changes apply, by when, and which documents/configurations are affected?
Incidents, exercises, audit findings	Is the problem a missing rule, understanding, implementation, or operation?
Organization or supplier changes	Are owners, contacts, deputies, and authority still valid?
Technology or threat changes	Are configurations, authentication, remediation deadlines, and monitoring effective?

Set review intervals by risk. Policies and rules might be reviewed annually, while technical standards and procedures also need checks after relevant changes. Review and revision are separate. Record who reviewed, when, and why no change was needed where applicable.

Link exceptions and corrections to document management

If exceptions or gaps increase, assess feasibility, resources, and availability of approved services, alongside individual noncompliance. Notify owners before expiry and decide resolution, reassessment, or suspension. Avoid automatic extensions.

Leadership reviews should address significant residual risk, overdue actions, resource shortages, recovery results, and policy suitability. Record decisions, owners, and deadlines. Close audit findings only after configurations or operations have improved and results have been verified, rather than when a document is edited.

Example first 90 days

This is an implementation example; urgent incidents or high risks should not wait until day 90.

Period	Priorities	Expected evidence
Days 1–30	Identify important assets, owners, requirements, risks; draft policy	Clear scope and decision-makers for important activities
Days 31–60	Prepare rules, essential standards, onboarding/offboarding, incident and restoration procedures	Approval, configuration, training, necessary exceptions
Days 61–90	Operate, exercise, review access, test restoration, hold first review	Evidence, gaps, corrective plan, leadership decisions

Before publication or implementation

Terms, scope, owners, and approval authority agree across documents.
Mandatory requirements, recommendations, and examples are distinguishable; references work.
Configuration, people, and funding are ready; transition nonconformities are managed.
Communication, training, evidence, exception expiry, and old versions are controlled.
Sensitive internal information is appropriately restricted; changes and approvals are traceable.