A consultant colleague recently reached out with some questions on how to craft a good organizational information security policy. I’ve got experience with this, as a graduate-level legal instructor, a lawyer, and someone who frequently talks to communications technology practitioners. I can offer guidance on how to plan for, implement and manage organizational information security policies. But note that I am not offering a guarantee. That’s not an accident. I am, after all, a lawyer.
