he "documentation of IT security decisions" in an organization. NIST SP 800-12 categorizes IT Security Policy into three basic types: 1) Program Policy--high-level policy used to create an organization's IT security program, define its scope within the organization, assign implementation responsibilities, establish strategic direction, and assign resources for implementation. 2) Issue-Specific Policies--address specific issues of concern to the organization, such as contingency planning, the use of a particular methodology for systems risk management, and implementation of new regulations or law. These policies are likely to require more frequent revision as changes in technology and related factors take place. 3) System-Specific Policies--address individual systems, such as establishing an access control list or in training users as to what system actions are permitted. These policies may vary from system to system within the same organization. In addition, policy may refer to entirely different matters, such as the specific managerial decisions setting an organization's electronic mail (email) policy or fax security policy. (SP 800-35) (NISTIR)
Understand more election terms clearly
Get one important election term explained each week, with authoritative sources, practical context and related definitions.
he "documentation of IT security decisions" in an organization. NIST SP 800-12 categorizes IT Security Policy into three basic types: 1) Program Policy--high-level policy used to create an organization's IT security program, define its scope within the organization, assign implementation responsibilities, establish strategic direction, and assign resources for implementation. 2) Issue-Specific Policies--address specific issues of concern to the organization, such as contingency planning, the use of a particular methodology for systems risk management, and implementation of new regulations or law. These policies are likely to require more frequent revision as changes in technology and related factors take place. 3) System-Specific Policies--address individual systems, such as establishing an access control list or in training users as to what system actions are permitted. These policies may vary from system to system within the same organization. In addition, policy may refer to entirely different matters, such as the specific managerial decisions setting an organization's electronic mail (email) policy or fax security policy. (SP 800-35) (NISTIR)
Cite this term
Election Security Glossary. (2026). It Security Policy – T. In Election Security Glossary. Retrieved August 13, 2026, from https://electionsecurityglossary.com/glossary/it-security-policy-t
Sources
01
Single-source
Get the weekly election term
Receive one cited, source-backed election explanation in your inbox each week.