Information Security Standards

Security standards translate obligations into scope, configuration conditions, deadlines, and verification methods. Write requirements that implementers can apply and reviewers can assess, rather than instructions to “make it sufficiently secure.”

Here, a standard is an internal mandatory requirement. External ISO standards and NIST frameworks can inform it; adopting references alone does not establish conformance or certification.

Required fields

Field	Example
Requirement ID and authority	AC-01; access clause in management rules
Purpose and scope	Prevent unauthorized access to customer information services
Mandatory requirement	Use individually attributable IDs and apply MFA
Owner and timing	Service owner verifies before use begins
Verification and evidence	Configuration inventory, authentication test, account list
Exceptions and revision	Approver, compensating controls, expiry, revision history

Record out-of-scope decisions with reasons and approval. “Where possible” and “in principle” need explicit conditions and exception handling to support a compliance decision.

Examples by control area

The following are examples for a fictional organization. Intervals and deadlines are neither universal recommendations nor statutory values. Decide them from impact, contracts, threats, and implementation feasibility.

Area / ID	Example mandatory requirement	Example evidence
Classification: DC-01	Owners classify information as public, internal, or confidential. External sharing of confidential information is restricted to approved recipients and methods	Inventory, sharing approval, access list
Identity: AC-01	Apply MFA to customer information services and privileged accounts. Use individual IDs for people; register owners and purposes for service accounts	Settings, authentication test, account register
Access: AC-02	Approve grants and changes, review necessity quarterly, and disable departing staff access by departure time	Requests, reviews, disablement history
Endpoints: EP-01	Register work devices; enable storage encryption, automatic locking, managed updates, and endpoint protection. Prepare revocation and remote response for lost devices	Management compliance results, configuration records
Vulnerabilities: VM-01	For vulnerabilities with confirmed exploitation affecting internet-facing assets, assess impact within 24 hours of awareness and remediate or implement approved temporary mitigation within 72 hours	Assessment, remediation/retest, exception approval
Logging: LG-01	Record authentication, permission changes, confidential-data exports, and administrative actions. Protect against alteration and unauthorized viewing, synchronize clocks, and retain scoped logs for 180 days	Collection test, retention settings, access list
Backup: BK-01	Back up important business data daily; separate backup authentication and deletion permissions from production. Test restoration quarterly in an isolated environment	Job results, protection settings, restoration records
Cloud: CL-01	Assess data classification, responsibility allocation, authentication, sharing, logs, recovery, and exit data handling before use	Assessment, approval, settings review
Encryption and keys: CR-01	Use approved encryption for confidential data in transit and at rest. Manage key generation, storage, access, renewal, revocation, and recovery	Approved methods, key register, access/action records

Prioritize vulnerabilities using exploitation, exposure, business impact, and available mitigations, as well as severity scores. Define approval, monitoring, and reassessment when deadlines cannot be met. Do not log passwords or private keys; assess personal information, retention, and authorized viewers.

Translate classification into handling conditions

Example class	Information	Example conditions
Public	Approved product information	Check content and publication authority before release
Internal	Internal procedures and operational messages	Use managed internal storage and assess external sharing
Confidential	Customer lists, contracts, unreleased designs	Limit access to need, use protected sharing, and dispose of information so it is difficult to recover after retention expires

Assess personal-information handling requirements separately from these labels. Define owners, retention, removal conditions, and disposal verification so classification changes actual behavior.

Authentication and password requirements

Do not reuse blanket requirements for frequent password changes or mixed character types without checking their basis. NIST SP 800-63B-4 does not require periodic changes without evidence of compromise or character-composition rules. It emphasizes length, rejecting compromised or otherwise unsafe passwords, and limiting attempts. Within its scope, it requires at least 15 characters for password-only authentication and allows a minimum of eight when the password is part of MFA. These are requirements within that publication’s scope, not legal obligations for every internal system. NIST: SP 800-63B-4, Passwords

Define MFA scope, authentication methods, password management tools, revocation and changes after compromise, account recovery, and service-account secrets together. Select methods according to the target system and risk.

Derive controls from recovery objectives

If order processing must resume within four hours and lose no more than one hour of data, its recovery time objective (RTO) is four hours and recovery point objective (RPO) is one hour. A daily backup alone may not meet that RPO.

Select frequency, backup method, storage, and recovery procedures from business objectives. Test dependencies such as authentication, networking, and connected services, alongside data restoration. Backup success and business recovery are separate checks.

Example compliance register

ID	Asset	Status	Evidence	Action
AC-01	Customer management SaaS	Conforming	MFA settings and test	None
LG-01	Legacy ordering system	Nonconforming; approved exception	Log settings; EX-01 approval	Improve retention; assign owner and deadline
CL-01	Paper storage room	Out of scope	Scope decision	Assess under physical-security standard

An approved exception does not turn nonconformity into conformity. Track technical compliance and exception approval separately.