Security Policy Quality: A Multiple Constituency Perspective

Although organizations are taking security policy more seriously and are beginning to adopt a lifecycle approach to security policy development, how to assess the quality of security policy is still an unaddressed issue. This paper describes the results of two case studies focusing on a multiple constituency perspective of security quality assessment in organizations. Multiple constituency theory states that multiple stakeholders should be involved in any assessment of effectiveness. The main conclusion is that quality assessment needs to be carefully managed to ensure that you have a balanced approach and to ensure that stakeholders have adequate skills and training to assess quality.