Information security policies, standards and guidelines are derived from a set of fundamental principles (axioms).

It should be possible to derive any given security policy, standard or guideline from these axioms, with the addition only of common sense.

Individuals with a knowledge and understanding of these axioms and who have applied them in an organisational environment are deemed security experts.

The fundamental principles must be

• simple
• free of jargon
• common sense

The extent to which principles should be applied will be interpreted differently by different groupings of people, as the principles will be influenced by culture.

Information is one of the organisation's most valuable resources. Information assets include the information itself and the means by which that information is stored, transported and processed. Without such information assets, the organisation would not be able to pursue its objectives.

Information can be harmed by affecting one or more of its properties:-

• Availability - being accessible and usable when needed
• Integrity - being complete, accurate and fit for purpose
• Confidentiality - being private within a predetermined group

The world where information is stored, transported and processed is complex. No single person understands the entirety of the possible interactions within a set of information storage/process/transport mechanisms. There is potential for loss or harm to information through an action or indeed inaction. It is not always possible to predict the outcome. Add to that the potential for catastrophe from the natural world, and information is at noticeable risk of loss or harm.

We are all fallible. Some individuals will be hostile toward some information. Some individuals will not take due care. Some will not easily understand instructions. It is likely that information will suffer loss or harm through accident. It is possible that information will suffer loss or harm through deliberate acts.

Valuable information requires protection. Information shall be protected by controls designed to minimise loss or harm through accident, negligence or deliberate actions.

The primary leaders within an organisation have a duty of care to ensure that due diligence is paid to information security. They are responsible and accountable for the overall actions of an organisation and are thus ultimately responsible for all information within the organisation. To discharge that responsibility they must ensure that responsibility and appropriate authority are delegated throughout the organisation

Information shall be assigned an owner who will ensure appropriate levels of protection are applied.

Consistent with financial risk and operational risk, information risk shall be considered and afforded a priority in all decisions within an organisation.

A risk assessment process balancing vulnerability to threats against cost shall be used in deciding appropriate controls to be used to protect information.

Each individual shall be accountable for their actions and have a duty of care to ensure due diligence is afforded to information security. Accountability can not be delegated.

Information assets should be secured unless specifically authorised otherwise. Information assets include information and the means by which that information is stored, transported and processed.

Information should be made available to enable organisational operations to function.

Some information shall have additional restrictions applied to ensure access only by those with an authorised ‘need to know’.

From 2.1 Information is Valuable and 2.6 Top Management Due Diligence and 2.7 Information Ownership the primary leaders within an organisation will appoint an individual to take responsibility for how information within the organisation is stored, processed and transported. This individual will be referred to here as the Chief Information Officer.

From 2.1 Information is Valuable and 2.6 Top Management Due Diligence and 2.7 Information Ownership. The primary leaders within an organisation will ensure the appointment of an individual to take responsibility for setting policy on how information assets within the organisation are protected. This individual will be referred to here as the Chief Information Protection Officer.

From 2.1 Information is Valuable and Common Sense, not all information assets will have the same value. From 2.13 Need to Know, individuals in the organisation will need to know the rules governing behaviour towards different types of information assets. It is therefore important to define the policy, standards and guidelines that describe this.

From 2.1 Information is Valuable and 2.5 Information Protection using 2.9 Risk Assessment. Because a) the loss of information is costly and b) it is costly to correct information after an incident and c) because many controls cost little to put into effect :- There is a baseline set of controls, which is cost effective to apply to all information within an organisation.

Because 2.4 Individuals are human and may do things that they ought not, they should not be placed in positions where it is easy to do the wrong thing. For example, the person who is allowed to create accounts that may be sent payments should not be the same person who authorises payments to those accounts, lest they create false accounts and siphon the organisation's funds into them.

From 2.1 Information is Valuable and Common Sense, not all information will have the same value.

From 2.13 Need to Know, individuals in the organisation will need to know the relative sensitivity of different information. It is therefore useful to categorise information into groups that have roughly similar value.

Working with the 2.7 Information Ownership using 2.9 Risk Assessment to extend 2.5 Information Protection beyond 3.3 Baseline Controls, the different categories can then be given appropriate extra protection beyond the baseline as appropriate.

From Common Sense, this will be easier and more comprehensive if organised logically and hence it is sensible to maintain a register of information assets.

From Common Sense, a categorisation of information is information in its own right. From 2.7 Information Ownership an owner should be assigned to the categorisation. This individual will be referred to as the Information Classification Officer.

The Information Classification Officer will define the classification policy and provide guidelines on how it will be operated in practice.

From 2.1 Information is Valuable and 3.4 Separation of Duties, the Information Classification Officer will not be the person who administers other information controls.

From 2.3 The Information World is Complex and 2.4 Individuals are human, there are an infinite number of ways by which 2.2 Information can be harmed. The collective term normally given to these is 'Threats' and the likelihood of a particular threat occurring is often referred to as the 'Vulnerability'.

Whilst attempts have been made to describe using mathematics the relationship between Risk (2.9 Risk Assessment) and 3.6 Threats and Vulnerabilities - often because the use of mathematical symbols can give some insight - it is difficult to be rigorous with the maths. There is a relationship where part of the overall Risk is a combination of the impact of a specific threat on information and the vulnerability of the information to that threat. However, to describe this relationship properly requires use of notation not used by the average person. To describe risk using only basic arithmetic symbols leads to an inaccurate description.

From Common Sense, individuals are capable in and of themselves of storing, processing and transporting information. That information may give them a value that is separable from their inherent value as human beings.

From 2.4 Individuals are human and 2.9 Risk Assessment the risk to information assets from individuals should be reduced by assessing their risk to the organisation before allowing access to categories of information (e.g. prior to employment, prior to promotion, prior to assignment to a sensitive project).

From 4.2 Clearance and 2.5 Information Protection, controls should be introduced e.g. via the contract of employment to limit risk posed by individuals, and to clarify the consequences of inappropriate behaviour. E.g. confidentiality clauses, disciplinary processes etc. Particular care shall be taken when employing individuals (or companies as they are collections of individuals). Further care must be taken on termination.

From 2.4 Individuals are human, 2.3 The Information World is Complex and Common Sense, risk can be reduced further by appropriate education and training. E.g. information responsibilities in job descriptions, job specific training, awareness of policy etc.

From 4.1 Individuals are Information Assets, 2.1 Information is Valuable and 2.5 Information Protection, individuals with access to particularly valuable information may need extra protection. There are circumstances in which the information that an individual knows will result in threats against them and their families. Consideration should be given to this using 2.9 Risk Assessment.

From 2.1 Information is Valuable and Common Sense, not all information assets will have the same value. From 2.13 Need to Know, individuals in the organisation will need to know the rules governing behaviour towards different types of information assets. It is therefore important to define the policy, standards and guidelines that describe this. From 2.6 Top Management Due Diligence the primary leaders in an organisation must support the policy, standards and guidelines as the embodiment of the requirements for security.

From 2.1 Information is Valuable and 2.6 Top Management Due Diligence and 2.7 Information Ownership. The primary leaders within an organisation will ensure the appointment of an individual to take responsibility for setting policy on how information assets within the organisation are protected. This individual will be referred to here as the 3.1.2 Chief Information Protection Officer. Using 2.9 Risk Assessment and Common Sense, the CIPO will work with the primary leaders of the organisation to justify and create a Security Group that is appropriate for the organisation. The group will be responsible under the CIPO for setting and policing information security policy.

From 2.1 Information is Valuable and Common Sense, not all information will have the same value.

From 2.13 Need to Know, individuals in the organisation will need to know the relative sensitivity of different information. It is therefore useful to categorise information into groups that have roughly similar value.

Working with the 2.7 Information Ownership using 2.9 Risk Assessment to extend 2.5 Information Protection beyond 3.3 Baseline Controls the different categories can then be given appropriate extra protection beyond the baseline as appropriate.

From Common Sense, this will be easier and more comprehensive if organised logically and hence it is sensible to maintain a register of information assets.

From 2.4 Individuals are human and 2.9 Risk Assessment the risk to information assets from individuals should be reduced by assessing their risk to the organisation before allowing access to categories of information (e.g. prior to employment, prior to promotion, prior to assignment to a sensitive project).

From 2.4 Individuals are human and 2.9 Risk Assessment and 2.5 Information Protection controls should be introduced e.g. via the contract of employment to limit risk posed by individuals, and to clarify the consequences of inappropriate behaviour. E.g. confidentiality clauses, disciplinary processes etc.

From Common Sense risk can be reduced further by appropriate education and training. E.g. information responsibilities in job descriptions, job specific training, awareness of policy etc.

From 2.5 Information Protection and 2.9 Risk Assessment the risk to information assets should be assessed and appropriate protection provided.

From 2.5 Information Protection and 2.9 Risk Assessment the risk to information assets should be assessed and appropriate protection provided.

[Note further work required on 6-10]

Personal Data must be:

From 2.4 Individuals are human, 2.3 The Information World is Complex and Common Sense, risk can be reduced further by appropriate education and training. E.g. information responsibilities in job descriptions, job specific training, awareness of policy etc.

From 2.10 Individual Accountability and 2.6 Top Management Due Diligence, individuals are accountable and it is a management responsibility to ensure individuals are clear what they are accountable for.

From 2.10 Individual Accountability and 2.6 Top Management Due Diligence, individuals are accountable and it is a management responsibility to ensure individuals are clear what they are accountable for.

From 2.4 Individuals are human, 2.3 The Information World is Complex and Common Sense, risk can be reduced further by appropriate education and training. E.g. information responsibilities in job descriptions, job specific training, awareness of policy etc.

From 2.1 Information is Valuable and Common Sense, not all information assets will have the same value. From 2.13 Need to Know, individuals in the organisation will need to know the rules governing behaviour towards different types of information assets. It is therefore important to define the policy, standards and guidelines that describe this.

From 2.4 Individuals are human, 2.3 The Information World is Complex and Common Sense, risk can be reduced further by appropriate education and training. E.g. information responsibilities in job descriptions, job specific training, awareness of policy etc. From 2.6 Top Management Due Diligence it is a management responsibility to ensure appropriate amounts of time are spent on awareness and education.

From 2.10 Individual Accountability and 2.6 Top Management Due Diligence, individuals are accountable and it is a management responsibility to ensure individuals are clear what they are accountable for.