Data security policies should include all activities to preserve the authenticity and accuracy of information and data through the entire chain of custody. Data security policies should also include efforts to ensure validity, integrity and appropriateness for the particular viewer in specified situations. Security policies set the stage for privacy. Privacy takes into account who has access to what information and data on school computer systems and the vulnerabilities in the systems throughout the entire process of information collection, use, storage, and transmission. The need to protect information and data must be balanced against the need to make the information and data easily accessible to those who are authorized and need to use it.
Security policies facilitate consistent implementation of controls.
They establish a standard and provide the basis to document compliance with system requirements. They also form the basis for disciplinary action if needed. Security policies provide a systematic way for an organization to help avoid liability for negligence and breach of fiduciary duty. The security system policies should be easy to understand and used to ensure that the system's safeguards are not circumvented. A well-articulated data security policy should guide security product selection and implementation.