What is a policy ?

• A document having 2 parts :

  • How much security is required ?
  • What auditing will you do ?

• Must ALWAYS start with :

  • “That which is not permitted is prohibited”
  • Check RFC1244 and RFC1281 for more information