Theory: Governance, the Policy Lifecycle & Common Policy Types
A policy document on its own changes nothing. Governance is the system of people, responsibilities and processes that decides who writes a policy, who approves it, who enforces it and when it is reviewed. This lesson covers who owns each level of policy at MediCare Plus Hospital, the five-stage policy lifecycle, the four policies every organization needs, and how policy content is derived directly from the risk register.
Who Owns a Policy? The Governance Structure
Governance is not just documents; it is the people accountable for them.
| Role | Responsibility |
|---|
| Hospital Board / Executive | Approves the top-level policy. Accountable to regulators and the public. |
| CISO / Security Officer | Owns policy content: drafts and proposes updates, monitors compliance. |
| IT Manager | Owns standards and procedures, the operational detail beneath policy. |
| All staff | Must comply. Often the first to notice when a policy no longer fits reality. |
Diagram loads as you scroll.
Security governance means that every policy has a clear approver (Board), owner (CISO), implementer of the detailed rules (IT Manager), and people bound by it (all staff), so that someone is accountable at each level.
Common mistake: naming a department (“IT is responsible”) instead of a role. A department cannot be held accountable; a named role (e.g. “the CISO audits compliance quarterly”) can.
The Policy Lifecycle
A policy is never “done”. It is a cycle; miss a stage and the policy goes stale or gets ignored.
Diagram loads as you scroll.
| Stage | What happens | What goes wrong if skipped |
|---|
| 1. Draft | The owner (CISO) writes the policy from a risk or legal requirement | No rule exists |
| 2. Review | Stakeholders (IT, clinical departments, legal, HR) check it is correct and workable | Impractical or conflicting rules |
| 3. Approve | The right authority (the Board for policy) signs it off | No authority; staff can ignore it |
| 4. Publish & Train | Staff are told about it and taught what it means for them | Nobody knows the rule exists, so nobody follows it |
| 5. Periodic Review | Scheduled re-check (e.g. annually) | The policy goes stale as risks and technology change |
Periodic Review often loops straight back to Draft when risk, law or technology changes, for example after a new incident, a new regulation, or the introduction of AI-driven tools.
Four Policies Every Organization Needs
| Policy type | Purpose |
|---|
| Acceptable Use Policy (AUP) | What staff may and may not do with organizational IT resources |
| Access Control Policy | Who can access what, and on what basis (role, need-to-know) |
| Incident Response Policy | What happens the moment a breach or incident is suspected |
| Data Classification Policy | How data is labelled by sensitivity and handled accordingly |
Acceptable Use Policy (AUP)
- Purpose: defines what staff may and may not do with IT resources: devices, network, email, internet access.
- Typically covers: personal-use limits on organizational devices; prohibited activities (e.g. installing unauthorized software); consequences for violation.
- At MediCare Plus: after a nurse’s personal USB drive introduced malware to a workstation, the AUP now explicitly bans unauthorized removable media on clinical systems:
“Staff must not connect personal USB drives or removable media to any clinical workstation. Software installation on hospital devices requires prior approval from IT.”
Access Control Policy
- Purpose: governs who can access which systems and data, and on what basis, usually role-based and following least privilege.
- Typically covers: role-based access assignment; the approval process for new access requests; periodic access review and revocation on role change.
- At MediCare Plus: the risk “former contractor still has EHR access” led to:
“Access must be revoked within 24 hours of any role or employment change, with quarterly access recertification. Shared or generic login accounts are prohibited.”
Incident Response Policy
- Purpose: sets out what must happen, and who is responsible, the moment a security incident is suspected or confirmed.
- Typically covers: who to notify and how fast; roles during an incident (containment, communication, legal); post-incident reporting requirements.
- At MediCare Plus: after discussing the Hugging Face case (where early alerts were not escalated in time), the hospital added a clause for AI-driven tools:
“Any suspected incident must be reported to the IT Security team within 1 hour of discovery. This includes anomalies involving AI-driven tools or agents.”
Data Classification Policy
- Purpose: defines categories of data sensitivity (e.g. Public, Internal, Confidential, Restricted) and how each must be handled.
- Typically covers: classification labels and criteria; handling rules per label (storage, transmission, disposal); who may assign or reclassify data.
- At MediCare Plus: patient health records are classified Restricted, which triggers encryption at rest, MFA for access, and a 7-year retention and secure-disposal rule:
“Patient health records are classified ‘Restricted.’ All Restricted data must be encrypted at rest, require multi-factor authentication for access, and be retained for 7 years with secure disposal thereafter.”
To match a scenario to a policy type, ask what the scenario is about: behaviour with IT resources → AUP; who gets in → Access Control; what to do when something goes wrong → Incident Response; how sensitive the data is and how to handle it → Data Classification.
From Risk to Requirement
Policy content is not invented from scratch; it comes directly from what the risk register already says. The pattern is: pick a risk → decide what requirement closes it.
| Risk register entry (Week 3) | Policy content |
|---|
| Shared login used by multiple nurses on ward workstations (High likelihood, High impact: Critical) | Access Control Policy: every staff member must use individually assigned credentials. Shared accounts are prohibited. |
| Former contractor retained EHR access 45 days after the contract ended | Access Control Policy: access must be revoked within 24 hours of a role or employment change, with quarterly access recertification. |
Diagram loads as you scroll.
Worked Examples
Exercise 1
At MediCare Plus, who should do each of the following: the Hospital Board, the CISO, the IT Manager, or all staff?
a) Approve the hospital-wide Information Security Policy.
b) Draft an update to the Access Control Policy after a new law is passed.
c) Write the step-by-step procedure for disabling an account when an employee leaves.
d) Follow the rule that screens must be locked when unattended.
e) Check each quarter whether departments are complying with the Access Control Policy.
Show solution ↓Hide solution ↑
Solution
Match each task to the governance role that owns it.
a) Approving top-level policy: Hospital Board / Executive.
b) Owning policy content and drafting updates: CISO.
c) Procedures are operational detail: IT Manager.
d) Complying with policy: All staff.
e) Monitoring compliance: CISO.
a Board, b CISO, c IT Manager, d All staff, e CISO.
Exercise 2
(Mini-case) MediCare Plus’s Board approved a new Acceptable Use Policy six months ago and it was saved on the intranet. An audit finds that most nurses have never heard of it, and staff are still plugging personal USB drives into clinical workstations. Which stage of the policy lifecycle failed, and what should be done?
Show solution ↓Hide solution ↑
Solution
- The policy was drafted, reviewed and approved (the Board signed it).
- But staff do not know it exists, so the Publish & Train stage failed: saving a file on the intranet is not the same as communicating it and training people.
- A policy that nobody knows about cannot be followed, so the risk (malware via USB) is untreated in practice.
The Publish & Train stage failed; the hospital should actively communicate the AUP to all staff (for example in ward briefings and onboarding), train them on what it means for them, and then confirm awareness, with compliance monitored by the CISO.
Exercise 3
Which of the four common policy types would mainly address each risk?
a) Staff install unapproved browser extensions on hospital PCs.
b) Nobody knows whom to call when ransomware appears on a ward computer at 2 a.m.
c) Patient lab results and the cafeteria menu are stored and emailed in exactly the same way.
d) A transferred nurse still has access to the records of her old department.
Show solution ↓Hide solution ↑
Solution
Ask what each risk is about.
a) What staff may do with IT resources: Acceptable Use Policy.
b) What happens the moment an incident is suspected (who to notify, how fast): Incident Response Policy.
c) Data of very different sensitivity handled the same way: Data Classification Policy (lab results would be Restricted, the menu Public).
d) Access not revoked on role change: Access Control Policy.
a AUP, b Incident Response, c Data Classification, d Access Control.
Exercise 4
Explain how the Hugging Face incident (Week 2) led to a change in MediCare Plus’s Incident Response Policy, and which stage of the policy lifecycle this illustrates.
Show solution ↓Hide solution ↑
Solution
- In the Hugging Face case, the company’s security systems did detect early signs of unusual activity, but the alerts were not escalated to the human response team quickly enough, and the intruder was an autonomous AI agent.
- MediCare Plus learned two lessons: escalation must be fast and time-bound, and anomalies involving AI tools must be treated as possible incidents. It therefore added: “Any suspected incident must be reported to the IT Security team within 1 hour of discovery. This includes anomalies involving AI-driven tools or agents.”
- A new type of threat (a change in risk and technology) triggered a re-examination of an existing policy, which loops from Periodic Review back to Draft.
The case showed that unescalated alerts and AI-driven threats were not covered, so the hospital added a 1-hour reporting rule covering AI agents; this is the Periodic Review → Draft loop of the lifecycle.
Exercise 5
MediCare Plus’s risk register contains: “Shared login used by multiple nurses on ward workstations: Critical.” Which policy type should address it, and what requirement would close the risk? Explain why this requirement reduces the risk.
Show solution ↓Hide solution ↑
Solution
- Policy type: the risk is about who can access clinical systems and whether access is traceable, so it belongs in the Access Control Policy.
- Requirement: “Every staff member must use individually assigned credentials. Shared or generic accounts are prohibited.”
- Why it works: with a shared login, any action in the EHR cannot be traced to a single person, so misuse cannot be investigated and nobody is accountable. Individual credentials make every access attributable to a named user, enable per-person revocation when someone leaves, and deter misuse because staff know their actions are recorded.
Access Control Policy: all users must have individually assigned credentials and shared accounts are prohibited, making every access traceable to one person.