Writing Policies That Aren’t Miserable for Everyone Involved

The talk argues that corporate security and privacy policies are written for lawyers, auditors and HR rather than for the employees who must follow them, so almost nobody reads them. The speaker compares this to aviation pre-flight briefings, where pilots must review a huge volume of material and the regulator has admitted that critical details get lost.

The proposed fix is to split one monolithic policy into layers: a one-page overview with scope, objectives and references, then policy statements and implementation-agnostic standards, then platform-specific guidelines and task-level procedures, each linked up the chain. Employees read only what applies to their job, while a compiled printout still satisfies auditors. Changing one requirement means editing one document, and templates and an FAQ give developers a compliant starting point.

Practical advice includes keeping policy statements short and implementation-agnostic so they survive vendor changes, tying requirements to frameworks or documented risks to make engineering discussions easier, and keeping documentation aligned with the real environment. The overall lesson is to write for the people who apply the policy rather than for auditors alone.