Ferreira e Araújo (2008) present a organized plan in four phases for the development of an information security policy, as explained below. Phase ...

Ferreira e Araújo (2008) present a organized plan in four phases for the development of an information security policy, as explained below.

Phase 1 - Information gathering
The information gathering phase has four subphases, which include the following main activities:
Acquisition of existing security standards, norms, and procedures;
Identification of information technology needs and usage;
Collection of information about business processes, market trends, and risk controls;
Acquisition of information about the technological environment.

Phase 2 - Development of policy content and security norms
The second phase is responsible for consolidating the necessary content for the information security policy (PSI), also having four subphases, in which the following activities are carried out:
Policy management, by defining information security, management objectives, critical success factors, and policy maintenance;
Definition of rules and responsibilities, including the creation of a committee, definition of information owners and users, human resources, and internal audit;
Definition of information classification criteria, including levels, reclassification, storage, and disposal;
Development of information security procedures, such as internet usage, email, and backup procedures.

Phase 3 - Development of information security procedures
The third phase consists of constructing information security procedures, subdivided into three stages:
Search and identification of best SI practices used in the market;
Development of procedures and standards for presentation and discussion with the organization's top management, aligning with business needs;
Formalization of procedures in the integration process with corporate policies.

Phase 4 - Review, approval, and implementation of information security policies, norms, and procedures
The last phase is organized into only two stages, which consist of reviewing and approving information security policies, norms, and procedures. And finally, the concrete implementation of these policies, norms, and procedures, directly acting on the dissemination, involvement, and publicity of the Information Security Policy to all organization employees.