Security Policies

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

Included in this chapter:

Policy	What it governs	Scenario it owns
Acceptable Use Policy (AUP)	Permitted and prohibited use of company systems	An employee misuses the corporate network or shares a password
Password policy	Credential rules: length, complexity, reuse, rotation	Setting minimum password length or how often it must change
BYOD policy	Security rules for employee-owned devices accessing company data	An employee wants to read work email on a personal phone
Data Handling policy	Classification, labeling, retention, and destruction of data	Deciding how long to keep records or how to destroy old media
Privacy policy	Collection, use, sharing, and protection of personal information	How customer personal data is gathered and safeguarded
Change Management policy	Document, approve, test, implement, rollback of changes	An admin needs to change a production server's configuration

Cheat sheet

A security policy states the rule; the exam asks which policy owns the scenario
An AUP governs conduct on company systems
A BYOD policy governs the personal device, not the user's conduct
AUP vs BYOD: behavior on company systems vs the personal device itself
A Password policy is where credential rules are recorded
A Data Handling policy covers classification, labeling, retention, and destruction
A legal hold overrides the retention schedule
A Privacy policy is the personal-information slice of data handling
A Change Management policy makes changes accountable and reversible
Change management runs document, approve, test, implement, rollback
Rollback is the step that returns the system to its last known-good state
Emergency changes are expedited but still recorded
A policy states intent; a standard and a procedure carry it out
The Change Advisory Board reviews and authorizes changes before they go live
An account lockout threshold blunts brute-force guessing, but set too low it invites denial of service
Modern password rules: salt-and-hash storage, check against breach lists, change only on compromise

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet