Developing and Implementing IT and Digital Policies

Most organisations have IT policies, but many are long, technical documents written once for an audit and rarely read. They do not cover cloud services, remote work, personal devices, data sharing or artificial intelligence. Ownership is unclear, exceptions are granted informally, and nobody checks whether policies are applied in practice. When an incident or audit occurs, the gap between the written policy and actual behaviour becomes visible.

This programme treats policy as a governance tool rather than a document exercise. It moves from designing the policy framework and hierarchy, to drafting clear policies for the main IT and digital risk areas, to aligning them with regulatory and standard requirements, to implementing them through processes, technology and awareness, and finally to monitoring compliance and keeping policies current.

Built on recognised practice. The programme references ISO/IEC 38500 on the governance of IT, COBIT 2019, ISO/IEC 27001 and ISO/IEC 27002 on information security, the NIST Cybersecurity Framework 2.0, ISO 22301 on business continuity and ISO/IEC 42001 on AI management systems. It also considers how national cybersecurity and data protection requirements in the region shape policy content.

Decisions this programme improves. Which policies the organisation actually needs and at what level of detail; who owns and approves each policy; how to handle exceptions; how to balance security with usability and business needs; which controls and indicators show that policies are working; and when a policy should be reviewed or retired.

How it is delivered. Twenty hours across five sessions, built around one running case: an organisation adopting cloud services and generative AI tools with an outdated policy set and a forthcoming regulatory audit. Participants map gaps, redraft selected policies, design an implementation plan and define compliance indicators.

In-house option. For organisations, the programme can be tailored to your own policy library, regulatory obligations, technology environment and governance structure, and delivered to IT, security, legal, risk and business teams together.

Who Should Attend

IT leaders: IT directors, IT managers and heads of infrastructure and applications

Information security professionals: information security managers, cybersecurity officers and security architects

Governance, risk and compliance staff: compliance officers, risk managers and IT auditors

Digital transformation leaders: digital, data and enterprise architecture managers

Policy and legal staff: legal advisers, policy officers and regulators responsible for digital governance

Objectives

Design a policy framework that distinguishes policies, standards, procedures and guidelines

Assign clear ownership, approval and review responsibilities for each policy

Identify policy needs from business objectives, risk assessments and regulatory requirements

Draft clear, enforceable IT and digital policies in plain language

Map policies to recognised frameworks such as ISO/IEC 27001, NIST CSF 2.0 and COBIT 2019

Develop policies for emerging areas including cloud services, personal devices, data sharing and AI use

Plan policy implementation through processes, technical controls, training and communication

Manage policy exceptions and waivers with documented risk acceptance

Define indicators and monitoring methods to measure policy compliance

Establish a review cycle that keeps policies current with technology and regulation

Course Outline

Policy as a Governance Tool: Framework, Hierarchy and Ownership

Why IT and digital policies fail: templates, length, ownership gaps and no enforcement
Governance of IT under ISO/IEC 38500 and COBIT 2019
Policy hierarchy: policies, standards, procedures and guidelines
Roles of the board, executive management, IT, security, legal and business owners
Policy lifecycle: request, drafting, consultation, approval, publication and review
Policy management tools and document control

Identifying Policy Needs and Requirements

Linking policies to business objectives and risk assessment
Information security requirements under ISO/IEC 27001 and ISO/IEC 27002
Using the NIST Cybersecurity Framework 2.0 to test coverage
National cybersecurity, data protection and records requirements in the region
Audit findings, incidents and stakeholder input as policy drivers
Gap analysis of an existing policy library

Drafting Clear and Enforceable Policies

Structure, scope, definitions and responsibilities
Plain language and writing for different audiences
Core policies: acceptable use, access control, information classification and data protection
Operational policies: change management, backup, incident response and business continuity
Digital policies: cloud services, remote work, personal devices and social media
AI use policies and governance with reference to ISO/IEC 42001

Implementing Policies in Practice

Implementation planning: processes, technical controls and resources
Translating policies into standards, procedures and system configurations
Awareness, training and communication campaigns
Managing exceptions, waivers and risk acceptance
Third-party and supplier policy requirements
Change management and stakeholder resistance

Monitoring, Compliance and Continuous Improvement

Policy compliance indicators and dashboards
Automated compliance monitoring and its limits
Internal audit and self-assessment of policy compliance
Handling policy breaches: investigation and consequences
Review cycles and responding to new technology and regulation
Action plan: improving the IT and digital policy framework in your organisation

Competencies

IT and digital policy framework design

Policy ownership and lifecycle management

Policy needs and gap analysis

Clear and enforceable policy drafting

Framework and standard alignment

Cloud, remote work and AI use policy development

Policy implementation and exception management

Policy compliance monitoring

Policy review and continuous improvement

Vienna

Elite Academy can deliver its complete portfolio of professional training programs in Vienna. With a major international center for business, diplomacy and professional services, the destination suits both scheduled learning and tailored arrangements for organizations or individual professionals. As an Elite Academy training destination, Vienna provides access to our full portfolio rather than a city-specific set of specializations. The city is a major international center for business, diplomacy and professional services, creating a suitable environment for organizations developing their teams and for professionals attending independently. Upcoming scheduled courses are listed on this page, while any other Elite Academy program can also be requested for delivery in Vienna, subject to scheduling and delivery requirements. Explore the schedule or browse our training areas to find the right option.