4 ms·
I’d add another that’s nice to have: 3. The outcome we expect. (“What will happen if this is working.”)
by jt2190 6y ago
I’d add another that’s nice to have:
3. The outcome we expect. (“What will happen if this is working.”)
- IncRnd 6y agoHow does that differ from choice #1, 'The reasons a policy was put in place. ("Why did we do this?")'? A policy's expected outcome is correlated with why a policy was put in place.
- the8472 6y agoA policy might be put into place because a single event. The expected outcome can drastically differ depending on who writes the policy. E.g. it could be "this type of attack won't succeed again" vs. "even if this or a similar kind of attack succeeds it won't expose our entire data"
- IncRnd 6y agoThat's my exact point. A policy isn't random but created for an effect. As an examnple: If an HN disclosure leaks passwords and email addresses into the public domain, imposing a policy control is _meant_ to have the effect that such a disclosure would not happen again, or if it does to have a limited scope.