Add browsable INDEX.md, update README, and refine AI agent identity controls

2026-07-07 17:12:17 +02:00
parent 8d26180b8e
commit 2fec5e8fc4
5 changed files with 84 additions and 4 deletions
@@ -0,0 +1,59 @@
+# Policy and Guidance Index
+
+This page provides a browsable index of all organizational policies and implementation guidance in this repository.
+
+## Security
+
+Policies and practical guidance for information security, identity management, data protection, and cybersecurity operations.
+
+### Identity, Access, and Authentication
+
+| Document | Type | Description |
+|----------|------|-------------|
+| [Authentication Policy](Security/authentication_policy.md) | Policy | Normative requirements for authenticator assurance levels, MFA, and session management. |
+| [Authentication Guidance](Security/authentication_guidance.md) | Guidance | Practical hardening guidance for authentication systems and services. |
+| [Access Control Policy](Security/access_control_policy.md) | Policy | Requirements for granting, reviewing, and revoking access to organizational resources. |
+| [Access Control Guidance](Security/access_control_guidance.md) | Guidance | Implementation guidance for role-based access control and least privilege. |
+| [Password Policy (Generic)](Security/password_policy_generic.md) | Policy | System-agnostic password and authenticator policy. |
+| [Password Guidance (Generic)](Security/password_guidance_generic.md) | Guidance | System-agnostic password implementation guidance. |
+| [Password Policy (Microsoft 365 / AD)](Security/password_policy_m365_ad.md) | Policy | Microsoft 365 and Active Directory password and authenticator policy. |
+| [Password Guidance (Microsoft 365 / AD)](Security/password_guidance_m365_ad.md) | Guidance | Microsoft 365 / Active Directory password implementation guidance. |
+
+### Data Protection and Classification
+
+| Document | Type | Description |
+|----------|------|-------------|
+| [Data Classification Policy](Security/data_classification_policy.md) | Policy | Requirements for classifying organizational data by sensitivity. |
+| [Data Classification Guidance](Security/data_classification_guidance.md) | Guidance | Practical guidance for applying data classification labels and handling rules. |
+| [Data Retention and Disposal Policy](Security/data_retention_disposal_policy.md) | Policy | Requirements for retaining and securely disposing of data. |
+| [Data Retention and Disposal Guidance](Security/data_retention_disposal_guidance.md) | Guidance | Implementation guidance for retention schedules and secure disposal methods. |
+
+### Security Operations
+
+| Document | Type | Description |
+|----------|------|-------------|
+| [Incident Response Policy](Security/incident_response_policy.md) | Policy | Requirements for detecting, reporting, and responding to security incidents. |
+| [Incident Response Guidance](Security/incident_response_guidance.md) | Guidance | Playbooks and practical guidance for incident handling. |
+| [Logging and Monitoring Policy](Security/logging_monitoring_policy.md) | Policy | Requirements for security logging, monitoring, and alerting. |
+| [Logging and Monitoring Guidance](Security/logging_monitoring_guidance.md) | Guidance | Implementation guidance for log sources, SIEM, and detection rules. |
+| [Vulnerability and Patch Management Policy](Security/vulnerability_patch_management_policy.md) | Policy | Requirements for vulnerability identification, prioritization, and remediation. |
+| [Vulnerability and Patch Management Guidance](Security/vulnerability_patch_management_guidance.md) | Guidance | Practical guidance for patch deployment and exception handling. |
+| [Secrets Management Policy](Security/secrets_management_policy.md) | Policy | Requirements for storing, rotating, and protecting secrets and credentials. |
+| [Secrets Management Guidance](Security/secrets_management_guidance.md) | Guidance | Implementation guidance for secret vaults, rotation, and injection. |
+
+### Governance, Risk, and Compliance
+
+| Document | Type | Description |
+|----------|------|-------------|
+| [Acceptable Use Policy](Security/acceptable_use_policy.md) | Policy | Rules for acceptable use of organizational systems, networks, and data. |
+| [Acceptable Use Guidance](Security/acceptable_use_guidance.md) | Guidance | Practical guidance for interpreting and enforcing acceptable use rules. |
+| [Vendor Risk Management Policy](Security/vendor_risk_management_policy.md) | Policy | Requirements for assessing and managing risks from third-party vendors. |
+| [Vendor Risk Management Guidance](Security/vendor_risk_management_guidance.md) | Guidance | Implementation guidance for vendor assessments and due diligence. |
+| [Secure SDLC Policy](Security/secure_sdlc_policy.md) | Policy | Requirements for integrating security into the software development lifecycle. |
+| [Secure SDLC Guidance](Security/secure_sdlc_guidance.md) | Guidance | Practical guidance for secure design, coding, testing, and deployment. |
+| [Business Continuity and Disaster Recovery Policy](Security/business_continuity_dr_policy.md) | Policy | Requirements for continuity planning and disaster recovery. |
+| [Business Continuity and Disaster Recovery Guidance](Security/business_continuity_dr_guidance.md) | Guidance | Implementation guidance for continuity plans, backups, and recovery testing. |
+
+---
+
+*For contribution guidelines and licensing, see [README.md](README.md).*