birgðastefnu
Birgðastefna, literally “security policy” in Icelandic, is a formal document that sets the objectives, principles, and requirements for protecting an organization’s information, assets, personnel, and operations from threats. It defines the organization’s risk appetite, identifies critical assets, and outlines the roles and responsibilities of management and staff in safeguarding these assets. A birgðastefna typically covers both physical security and information security, including data handling, access control, incident response, and business continuity.
Scope and applicability: birgðastefna applies to all employees, contractors, and partners, and to all information systems,
Key components: a birgðastefna includes statements of intent, governance and accountability structures, and defined risk management
Relation to frameworks and law: organizations often align birgðastefna with international standards such as ISO/IEC 27001
Impact and purpose: the policy aims to reduce risk, protect privacy and critical operations, and maintain trust