What should be contained in a security policy?

📄 Project Abstract

This report looks at security and security policies especially for small and medium enterprises (SMEs). This is a growing area although traditionally "security has been largely ignored by both large and small companies because it is seen as a technical issue" (Heikkila, 2000) although the market is still worth "hundreds of millions of pounds" (Walker, 2003). This project has looked at the attitudes and use of SMEs with regards to security and how they differ from larger companies, through the use of case studies and questionnaires. Current information available for SMEs to create a security policy has also been assessed. The project has also looked at a number of actual security policies and table of contents of security policies. Collating all of this information I have created a generic security policy designed with SMEs in mind, which will allow them to quickly and easily create their own security policy.