A mid-level company is rewriting its security policies and has halted the rewriting progress because the company's executives believe that its major vendors, who have cultivated a strong personal…

Consulting moral and ethical standards introduces subjective criteria that vary by individual and organization, producing an inconsistent framework that is difficult to enforce or audit against defined compliance requirements.

Beginning with legal and regulatory requirements anchors the policy to externally mandated, verifiable standards such as HIPAA, PCI-DSS, or SOX rather than to vendor preferences shaped by business relationships. These frameworks define non-negotiable baselines that protect the organization from legal liability regardless of what any vendor recommends. Starting here gives the IT Director the objective authority needed to counter executive pressure to let vendors drive policy content.

Drafting a General Organizational Policy before identifying legal and regulatory requirements risks producing a document that omits or contradicts mandatory compliance controls.

Drafting a Specific Company Policy Plan before establishing the regulatory baseline can result in policies that are too narrow or misaligned with legally required security controls.