Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Who approves a policy, a standard and a procedure?

5 decision pointsThe pack behind this answer: Security Policy Management

Add to board memo

The short answer

Recommendation
Approve each document at its tier's level: executive management for policies, the Head of Information Security for standards and procedures after consulting the owner, and information security for guidelines. The top policy goes to the board or its equivalent, and nobody approves a document they own or wrote.
Reasoning
The tiers are approved at different levels because they change at different speeds and need different judgement. A policy commits the organisation, so the people who can commit it approve it. Standards and procedures change with the technology, so the security function that can judge them approves them. Approval is the only independent look at a document, which is why an owner or author never approves their own work, and the document goes to the conflict approver for its tier instead. Every version, minor or major, is approved in writing and dated, and a document is not in force until it is approved and published.
Considerations
  • The approvers are the defaults in the CISO Times policy pack. Your own framework standard names the actual roles. An approver of a higher tier may approve a lower-tier document; the reverse is never allowed.
  • The top policy goes to the board, a board risk committee it delegates to, the management board in a two-tier structure, or executive management. In a NIS2 or DORA entity the pack recommends the management body itself; the law is silent on delegation, so confirm with counsel.
  • When the usual approver owns or wrote the document, a policy goes to the rest of executive management without that member, and any other tier goes to executive management. In a small organisation, that may mean the other directors, or the board.
  • Where another document sets its own approval rule, the stricter of the two applies: the higher approver.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA security document is ready for approvalDecisionWhich tier is the document?DecisionIs it the top information security policy?DecisionIs the organisation a NIS2 or DORA entity?StepThe management body itself approves it, in its minutesStepThe board, or a board risk committee it delegates to, approves itDecisionIs it an ICT security policy of a DORA financial entity?StepThe management body approves it and its minutes show the dateStepExecutive management approves itStepThe Head of Information Security approves; owner consultedStepThe Head of Information Security approves; process owner consultedStepInformation security approves itDecisionDoes the usual approver own the document, or did they write it?OutcomeSend it to the conflict approver for its tierOutcomeApprove in writing and dated, then publish

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    A security document is ready for approval

    Every version needs approval at its tier's level, minor or major, and so does a retirement. A document is not in force until it is approved and published. Approval is in writing and dated: a minute, a signed approval page, or the approval record in your document system. That date is the document's approval date.

    In the pack

  2. Decision

    Which tier is the document?

    A policy says what the organisation commits to and why. A standard sets measurable requirements: settings, deadlines, minimums. A procedure says how a task is done, step by step, by named roles. A guideline is recommended practice and is not mandatory. Each document states its tier on its first page.

    In the pack

    See also

  3. Decision

    Is it the top information security policy?

    The top policy is the one every other security document sits under. It must be approved by the body that can commit the organisation. Topic policies, such as acceptable use or access control, are approved by executive management.

    In the pack

  4. Decision

    Is the organisation a NIS2 or DORA entity?

    Under NIS2 the management body approves the cybersecurity risk-management measures, and under DORA it is responsible for the ICT risk management framework. This pack recommends that the management body itself approves the top policy and does not leave it to a committee. The law does not say whether it may delegate, so confirm with counsel. If you are not sure whether you are in scope, take the stricter route.

    In the pack

    See also

  5. Step

    The management body itself approves it, in its minutes

    The management body is the body that directs the organisation: the board of directors; in a two-tier structure, the management board, and the supervisory board too where the law counts it; where there is no board, as in an owner-managed company, the people who run it. NIS2 does not define the term, and DORA takes it from the financial-sector law that governs the entity (Article 3(30)). This pack recommends that the management body itself approves the top policy and does not leave it to a committee. The law does not say whether it may delegate, so confirm with counsel. Its minutes give the approval date the policy shows.

    In the pack

  6. Step

    The board, or a board risk committee it delegates to, approves it

    Outside NIS2 and DORA, the top policy is approved by the board or its equivalent. Who that is depends on how you are governed: the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management.

    In the pack

  7. Decision

    Is it an ICT security policy of a DORA financial entity?

    In a DORA financial entity, every ICT security policy shows the date of its formal approval by the management body, not only the top policy. The pack says to send each such policy to the management body. If you are not sure the policy counts as an ICT security policy, take the stricter route.

    In the pack

  8. Step

    The management body approves it and its minutes show the date

    Bring the policy to the management body itself, and record its formal approval date in the document and the register. This is the pack's rule for ICT security policies in a DORA financial entity.

    In the pack

  9. Step

    Executive management approves it

    Every other policy that is not an ICT security policy of a DORA entity is approved by executive management, and the decision is minuted. The owner presents the final text and takes no part in the decision. A minor version may be approved in writing without a meeting. In a NIS2 entity, ask counsel whether the management body should see the other policies too.

    In the pack

  10. Step

    The Head of Information Security approves; owner consulted

    A standard turns a policy into measurable requirements, so the security function approves it after consulting the document's owner. An approver of a higher tier, such as executive management, may approve a standard instead. The reverse is never allowed.

    In the pack

  11. Step

    The Head of Information Security approves; process owner consulted

    A procedure is usually drafted by the process owner's team and consulted on with the people who carry it out. The Head of Information Security approves it. The process owner then communicates it to the people who use it; it is not acknowledged individually.

    In the pack

  12. Step

    Information security approves it

    A guideline is recommended practice: nobody is non-compliant for not following it, so information security approves it. A guideline may not contain a 'must' statement. If something must be done, it belongs in a standard or procedure, with that tier's approver.

    In the pack

  13. Decision

    Does the usual approver own the document, or did they write it?

    Approval is the only independent look at the document, so nobody approves a document they own or wrote. This comes up often: the Head of Information Security owns or drafts many standards, and executives own policies. In a small organisation one approver may cover two tiers, but this rule never bends.

    In the pack

  14. Outcome

    Send it to the conflict approver for its tier

    For a policy, the rest of executive management approves, without the member who owns or wrote it. For a standard, procedure or guideline, executive management approves. In a small organisation where the managing director owns or wrote a policy, that means the other directors, or the board.

    In the pack

  15. Outcome

    Approve in writing and dated, then publish

    The approver approves, returns with required changes, or rejects, and confirms whether the change is material. In the pack's defaults the decision comes at the next meeting or within 20 working days, and publication follows within 5 working days. The document is in force from its effective date, which is no earlier than publication.

    In the pack

Practical checklist

  1. Confirm the document's tier from its first page.
  2. For a policy, check whether it is the top information security policy, whether you are a NIS2 or DORA entity, and, in a DORA financial entity, whether it is an ICT security policy.
  3. Send the approval pack to the tier's approver: the final text, a summary of changes, the material-change classification and the comment log.
  4. If that approver owns or wrote the document, send it to the conflict approver for its tier instead.
  5. Have the approver approve, return with required changes, or reject, in writing and dated, and confirm whether the change is material.
  6. Set the version, approval date and next review date, then publish the approved version and update the register.

Evidence to have ready

  • For each version, the dated approval record: a minute, a signed approval page or the approval record in your document system.
  • For the top policy in a NIS2 or DORA entity, the management body's own minutes approving it.
  • Evidence that no approver owned or wrote the document they approved.
  • The register, showing each document's approver and approval date.

Assumptions

  • Your organisation uses four tiers of security document: policy, standard, procedure and guideline.
  • The approvers shown are the defaults in the CISO Times policy governance pack. Your own framework standard names the actual roles.

Not covered here