A critical component of data governance is the written
information security program or policy, or "WISP" for
short. WISPs are important for three reasons: first, they are often
required by specific statutes or regulations. Second, their
drafting and maintenance often force organizations to consider more
closely the adequacy of their security practices. Third, they can
be excellent defenses against liability in the event of a data
security incident. Yet organizations often find themselves caught
by surprise when they learn that they are either legally required
to have a WISP, or ought to have one as a best practice or risk
mitigator.
This article discusses what a WISP is, when they are required,
what they are good for, why organizations should consider creating
and maintaining them, and what the future holds. In the end, you
will hopefully consider the WISP to be a critically important
component of your or your client's overall data governance
strategy.
