The Process of Writing Good Security Procedures

Jackie Lohrey reports:

"Security procedures represent the deployment phase of an overall or departmental security policy. Each procedure is an action step that supports one or more security objectives. Clear, well-defined and well-written procedures are crucial for effectively implementing any security policy. It’s vital to know how to write safety procedures that effectively communicate...what employees need and want to know...Follow general best practice recommendations for crafting clear, well-written procedures. Write from an action-oriented, instructional perspective outlining each step in the order it needs to be taken. Security procedures can have serious consequences if they’re not followed exactly, so each one should be written in a black-and-white fashion, leaving no room for subjectivity, personal judgments or individual interpretation. Consider the audience and write using correct terminology, spell out acronyms completely and define any terms that readers -- especially new hires -- may not understand...Start by thoroughly reviewing the security policy for which you’ll be adding a procedures section. Break the policy into its objectives components and then break each objective into a series of sub-components that will ultimately be converted into action steps...Take detailed notes if necessary to better understand security policy objectives...Craft a first draft that pares down information to include only what the reader needs to carry out the security procedure. Write out each step on a separate line, using an active voice and just enough words to clearly communicate the procedure...Conduct a practice run-through to make sure each step in the process is clear and understandable before crafting a final draft. If possible, enlist the help of individuals who will be expected to follow the procedure to ensure your perceptions of how clear the procedure is are correct. Modify verbiage or steps as necessary and then test the procedure again. When you’re sure security procedures are clear, well-written and effective, craft and distribute a final version."