Sample Security Policy Audit Interview

• Is there a security policy for your organization?
• Do you know where to find the security policy?
• Specific questions concerning the policy should go here:
  • Does your security policy permit personal email?
  • Does your security policy permit using online auction sites for personal items, if it is your lunch hour?
  • Is it ok to share your password with someone else?
  • Is it ok to let your children, friends, significant other, access your computer on the weekend while you are working?
  • May you bring in software that you have purchased to use on your computer?
  • What constitutes a good password? Should you write it down?
  • What types of things are safe or ok to download?
• What software is on your desktop machine?
• Do you turn off, or otherwise secure your machine when you leave for lunch, or for the day?
• operating system, patches, legal (or other) software goes here
• How do you report suspected security violations?