Our underwriter wants a written information security program. Do you write it?

A written information security program is a standing expectation in this industry. ALTA Best Practices calls for it, underwriters ask for it, and the Gramm-Leach-Bliley safeguards requirements sit behind it. What gets produced varies enormously in quality, and the difference is usually whether the document describes the company or describes a template.

What we write: the technical sections, accurately. Access controls and how they are administered, encryption at rest and in transit, network protection, endpoint security, patching, backup and recovery with tested recovery times, logging and monitoring, multi-factor authentication, vendor and remote access management, and the incident response technical procedure. Each written to describe what is actually configured in your environment, not what would be nice.

What has to come from you: the administrative and physical sections. Who the designated security coordinator is. Your employee screening. Clean desk and visitor procedures. Training attendance. Disciplinary process. Your risk assessment sign off. Management adoption. Those are governance, they belong to the company, and your underwriter and your examiner both know the difference.

And the evidence file, which is what actually gets examined. A policy claiming multi-factor authentication is one thing. A report showing it enabled for every user, dated, is another. We maintain that evidence continuously rather than assembling it in a panic the week before a review: access reviews, training completion, patch status, backup and restore test results, and the log of security incidents including the minor ones.

The practical failure mode worth avoiding. A practice adopts a strong policy, the environment drifts away from it over two years, and then an examiner or a plaintiff's attorney reads the policy and compares it to reality. The gap between what you said you do and what you do is worse than a modest policy honestly followed. We review the document against the environment annually for exactly that reason.