Security Policy Draft (Yahoo MDL (2018))

Use this to draft or update an enterprise security policy; defines required behavior and controls in policy language and supports consistency and auditability.

---

Purpose

This draft policy converts lessons and obligations from Yahoo MDL (2018) into enforceable internal requirements, control expectations, and governance responsibilities. It is structured for review by security leadership, legal, and affected business owners before formal adoption.

Hallucinated writing examples

Scenario: In an illustrative period during Yahoo MDL motion practice after public disclosures of large-scale account compromise (time), the Security Director (role) prepares a security policy draft (type) for Employees and contractors (policy draft circulation) (audience).

ENTERPRISE SECURITY POLICY — DRAFT

Policy title: Account Security, Logging, and Litigation Evidence Governance Policy
Version: 1.0 (Draft)
Owner: Chief Information Security Officer
Effective date: Upon approval
Last reviewed: June 2018
Context: Post-disclosure remediation and MDL No. 16-md-02752 governance needs

Purpose and Scope: This policy establishes required controls for account security, logging, evidence retention, and incident escalation in support of legal and governance obligations arising from public disclosures and MDL proceedings. It applies to engineering, security operations, and technology governance functions managing systems with user account data.

Policy Statement: The organization shall manage designated security controls through documented standards and approved workflows. Logging and evidence controls shall support legal hold and discovery-readiness needs. Exceptions shall be time-bound, risk-accepted by authorized leaders, and reviewed on a scheduled cadence.

Roles and Responsibilities: The CISO owns the policy and approves material exceptions. Security engineering defines standards and implementation guidance. Technology owners implement controls and maintain evidence. Legal and compliance review escalation and evidence-handling obligations.

Requirements: (1) Identity and privileged access controls shall follow least-privilege design and periodic recertification. (2) Logging and retention for designated systems shall meet legal-hold and forensic needs with documented coverage. (3) Incident escalation to legal and executive governance shall follow defined triggers and timelines. (4) Exception requests shall include rationale, compensating controls, owner, and revisit date. (5) Policy review shall occur at least annually; non-compliance shall be tracked to closure and escalated for repeated or material breaches.

Document-type guide: Security Policy Draft

Writing tips: Writing best practices — Security Policy Draft