General areas/sub topics:
- Acceptable Use Policy
- Backup Policy
- Use of cloud native storage like Google Drive, OneDrive, etc.
- Backup of organization data to personal storage (e.g. iCloud)
- Bring Your own Device Policy
- Encryption
- OS/Software updates
- Strong authenticastion to unlock
- Confidential Data Policy
- Data Classification Policy
- Email Policy
- Encryption Policy
- Developer use of encryption
- Operational use of encryption
- Third party encryption
- Device encryption
- Guest Access Policy
- Incident Response Policy
- Technical incidents (e.g. break in, ransomware)
- Financial incidents, e.g. use of stolen cards to purchase services/etc.
- Mobile Device Policy
- Network Access and Authentication Policy
- Network Security Policy
- Use of network services, e.g. HTTPS/HSTS requirements
- Outsourcing Policy
- Define outsourcing clearly, e.g. purchasing cloud services that are "controlled" by the user?
- Password Policy
- use of SSO, 2FA, MFA
- Use of password managers
- Physical Security
- Policy Remote Access Policy
- Retention Policy
- Third Party Connection Policy
- Use and Purchase of CLoud Services Policy
- User Acceptance Page VPN Policy
- Wireless Access Policy
- Use of organizational wireless resources
- Use of public wireless resources (e.g. coffee shops/conference WiFi)