Building Strong IT Policy Foundations for Local Government - Reorganised or Not!

In Parts 1 & 2 we explored the key elements involved in building, implementing, and maintaining an effective IT policy framework - who should be involved in policy development, why stakeholder engagement matters, and how to create and maintain effective policies.

This final part discusses common policy management challenges, policy ownership and review processes, and managing third-party supplier risk.

Common Policy Management Challenges

Creating and maintaining effective IT policies is about far more than producing documentation. Organisations must identify the right policies, position them within a clear governance framework, and keep them aligned with evolving business, technology and regulatory requirements.

A comprehensive IT policy framework aligned with recognised good practice will typically comprise 20 to 25 policies covering key operational areas, although the number will vary according to the organisation’s size, complexity, risk profile and regulatory obligations. Examples of user-focused policy topics include – Access Control, Password and Authentication, Information Management, and an Acceptable Use Policy. Technical policy examples include Network Management, Software Management and use of Cloud Services.

To ensure staff understand what is expected of them and apply also those expectations consistently and effectively, policies should be supported by related standards, guidelines, operational processes and procedures.

Once policies are in place, effective lifecycle management becomes essential. Staff changes may result in original authors leaving the organisation increasing the risk that continuity will be lost. Without clear ownership and defined review processes, policies can become inconsistent, duplicated or outdated.

Organisations frequently encounter policy lifecycle issues such as:

• Outdated or incomplete content
• Poor version control and change management
• Documents are not visible and difficult to find or access
• Policies are only used during staff induction
• Limited ongoing user awareness training and reinforcement

An ad hoc approach makes it difficult to build and sustain a strong culture of information security.

To ensure policies remain valuable as business and technology requirements evolve, organisations should consider:

• Keeping policies current - Treat policies as living documents and review them regularly to reflect changes in technology, business processes, and emerging risks.
• Building flexibility into policy design - Focus on principles, objectives, and governance outcomes rather than highly prescriptive requirements that may quickly become obsolete.
• Assessing technology impacts - Before introducing new technologies, evaluate how they may affect existing policies and identify any required updates.
• The relevance of best practice guidance and regulatory requirements - Align policies with recognised standards, industry guidance, emerging good practice and regulatory requirements.

The Importance of Policy Ownership and Review  

Policies should have clearly assigned owners who are responsible for reviewing content and coordinating updates to ensure the policies continue to be fit for purpose and remain current. As a general guide, policies should be reviewed:

• At least annually
• Following significant technology changes
• After major incidents or security events
• When standards, legislation or regulatory compliance requirements change

Effective ownership with defined review processes will help address policy management and lifecycle challenges and issues.

Managing Third-Party and Supplier Risk

Many organisations rely heavily on cloud providers, software vendors, managed service providers, consultants, and contractors.

As a result, information security responsibilities often extend beyond internal staff and systems so your IT policies should cater for these relationships and should clearly define: 

• Third-party security expectations
• Information handling requirements 
• Vendor access controls
• Reporting and incident management obligations 
• Contractual security requirements 

Third-party arrangements should also be subject to due diligence, ongoing monitoring, and periodic review to ensure security expectations continue to be met. 

How Can PPS Help?

Protocol Policy Systems specialises in helping organisations develop, deliver and maintain their IT policies. Our Policy Management as a Service offering establishes the foundations for a secure computing environment and improved cybersecurity maturity and resilience. Contact us today to discuss how the service can support your organisation.