1.6.15 Information security strategy 1.6.17.2 Directives/policies Defining, maintaining and monitoring a comprehensive information security strategy enables senior management to determine a clear policy and helps them enforce those requirements, as well as in risk management. Clear, practicable directives and policies for staff govern their conduct when dealing with security-related issues. They provide a framework and permit controls to be carried out in order to protect systems and enforce those policies. They also lay down the procedures that staff must follow, and define what the organisation expects of them. Policies and directives set the rules of compliance, and what sanctions apply in the event of an infringement. 1.6.16 Vendor management Vendor management involves identifying and managing information risks connected with external providers (i.e. vendors of hardware and software, providers of outsourced services, and cloud service providers, etc.). The inclusion of information security requirements in formal contracts should minimise risk here. 1.6.17 The human element Organisations face a range of challenges in handling the mistakes and deliberate actions of people within the ICT environment. Technical measures can never fully rule out incorrect operation, whether malicious or not. The more inexperienced or untrained staff within a business, the more susceptible it is to having its systems manipulated. Combating the activities of insiders with malicious intentions is a further challenge. When dealing with these challenges, businesses must address the following issues: 1.6.17.1 Staff employment cycles Information security should form part of the entire employment cycle, from appointment until departure. This includes securityrelated measures, such as the surrender of working tools (hardware, access to systems), or for access to buildings and other premises, and the attendant security responsibility. An appropriate training programme for staff should not only raise their awareness of security matters, but also define ‘secure’ conduct. The organisation should document the status and conduct of such training courses. 1.6.17.3 Procedures Security management falls within the responsibility of IT security, and is organised in terms of procedures. Its role is to protect corporate information and data. Organisations are also required to apply security management procedures to industrial control systems. This means defining procedures, the steps that must be taken, or how a certain system should be configured. These procedures should be standardised and repeatable. In this way, new staff are always trained to the same, consistent level of security, and it can be ensured that they are familiar with all of the necessary regulations and standards. The intrusion detection procedure is particularly important. Meanwhile, network-based security procedures take on a special significance in connection with manufacturer-specific protocols and legacy systems. 1.6.17.4 Roles and responsibilities in critical business environments Roles and responsibilities in critical business environments, procedures, applications (including supporting systems/networks) and information should be clearly defined and allocated to capable individuals. The aim is to foster a sense of independent responsibility among staff. The corporate culture that this creates helps to ensure that staff have information security in mind when going about their work. The aim is to ensure that staff are equipped with the skills, knowledge and tools that they need to uphold the organisation’s values and to comply with information security policy. Minimum ICT standard 2018 12