This framework guides your organization to agree on well-defined objectives for strategy and security of information. A set of digital security policies aimed to help you improve your digital safety and resiliency, and also promote digital rights and privacy for all, in Jordan and around the globe.
Information security focuses on three main objectives:
Confidentiality— considers proper authorization to access and use assetsIntegrity— considers data integrity and authenticityAvailability— considers ease of access to information or systems when necessary
Grouped and categorized you will find a set of policies that you may use as a basis to develop your own tailored set of policies.
A Digital Security Policy or Policy in this context identifies the rules and procedures for all individuals accessing and using an organization's IT assets and resources. Effective security is ensured by deploying and enforcing of such policies in the workplace and for all employees.
Every Policy consists of four different sections:
Objectives- what the policy aims to accomplish?Scope- who, what, and when this policy applies.Conditions- list of goals needed to accomplish our desired aims.Compliance Rules- list of responsibilities for compliance and actions to be taken in the event of noncompliance.
Free use disclaimer This policy was created by the Jordan Open Source Association (JOSA) for the Internet community.
All or parts of this framework can be freely used for your organization.
There is no prior approval required.
?> Looking to contribute? Read the contribution guide.
| Revision | Description | Date | Tag |
|---|---|---|---|
| 1.11 | The initial revision | 07/03/2022 | TID |
| 1.22 | The initial revision | 20/04/2022 | TID |
To better reference policy components in this toolkit we use the following notation systems.
Every Policy is denoted as CXPY where:
Xis a number which denotes the category of the digital policyYis a number which denotes the policy in that category
Every Condition is denoted as CXPY.CZ where:
Xis a number which denotes the category of the digital policyYis a number which denotes the policy in that categoryZis a number which denotes the condition for that policy
Every Complience Rule is denoted as CXPY.CRZ where:
Xis a number which denotes the category of the digital policyYis a number which denotes the policy in that categoryZis a number which denotes the condition rule for that policy
C1P1- On-Boarding PolicyC1P2- Off-Boarding PolicyC1P3- Threat & Harassment PolicyC1P4- Social Engineering Awareness PolicyC1P5- Acceptable Use Policy
C2P1- Travel PolicyC2P2- BYOD PolicyC2P3- Clean Disk PolicyC2P4- Removable Media Policy
- Account Management
C3P1- Account Security Question PolicyC3P2- Account Recovery PolicyC3P3- Two-Factor Authentication Policy
- Passwords
C3P4- Password Construction PolicyC3P5- Password Recycling PolicyC3P6- Password Managers Policy
- Social Media
C3P1- Browsers PolicyC3P1- Antivirus PolicyC3P1- VPN PolicyC3P1- Software Installation Policy
- General
C5P1- Secure Communication Policy
- Email
C5P1- Email PolicyC5P1- Email Retention Policy
C6P1- Data Accessibility PolicyC6P2- Database Access PolicyC6P3- Archiving PolicyC6P4- Data Retention PolicyC6P5- Disclosure PolicyC6P6- Information Logging Policy
C7P1- Remote Access PolicyC7P2- Disaster Recovery PolicyC7P3- Pandemic Response Planning PolicyC7P4- Risk Assessment Policy