I am doing some reading and promise to summarise it on my blog at www.securitybuddha.com

Have you read any good articles/blogs about policies and standards recently?

Care to share?

The Foundstone paper is OK but I suspect the author has only ever been a consultant. You can tell from the tone. We make everyone in the corp info sec dept own and maintain policies and standards. There is a big differnece between writing and publishing and owning and maintaining!

Ed,

FYI, both Vivek and I work as consultants and have previously been with large corporations as employees that wrote and implemented security policy.  I agree there is a big difference between writing, publishing, owning and maintaining policies, but I'm not sure why you pointed that out.  They main purpose of the document was to provide an example showing the correct and incorrect methods to write a policy.  

Your sentence "We make everyone in the corp info sec dept own and maintain policies and standards." works fine in some cases, but it triggers my interest.  Who owns the Human Resource, privacy and compliance, and physical security policies?

Owns or maintains?