With an intranet , the focus shifts to managing the flow of information within the organization. An intranet policy must include a greater emphasis on applications security, database security and virus management. The Internet section of the employee manual needs to be developed by a group representing all business areas of the agency, IT and operations functions. A policy without provisions for enforcement is a meaningless policy. Therefore, during the development of the policy, the organization must determine and incorporate the guidelines for failure to comply with the policies as stated.
Enforcement can range from warnings to termination.
Risk Management Information security is too broad an issue and resources are in too short supply for those responsible for security to be guessing what to buy. Risk management is the practice of defining and analyzing the threats to organization assets and capabilities, and for assisting management in optimizing the return on investment of information security resources. Risk management encompasses processes that collectively identify, evaluate, minimize, or eliminate problems or risks that adversely affect system resources. Within the framework of information security, risk management is a critical component to creating effective security policies and practices. It is not possible in today's world to have a risk-free data processing environment.