Definition of Information Systems Security Policies

Information systems security (ISS) is crucial in all and each one of the services provided by organizations. Among security measures, policies assume a central role in literature. A lot has been said about this issue over the last years, however, the analysis of some studies conducted by different authors show that this ISS measure has not yet been institutionalized in most companies. By approaching aspects intrinsically related to ISS policies, this paper aims to contribute suggestions of some actions which might be taken to formulate and implement an ISS policy. Methodologically, the study involved interviewing the officials in charge of information systems in 21 Small and Medium Sized Enterprises (SMEs) in Portugal. The results are discussed in the light of literature and future works are identified with the aim of enabling the implementation of ISS.