Security Policy Draft (Altaba / Yahoo SEC (2018))

Use this to draft or update an enterprise security policy; defines required behavior and controls in policy language and supports consistency and auditability.

---

Purpose

This draft policy converts lessons and obligations from Altaba / Yahoo SEC (2018) into enforceable internal requirements, control expectations, and governance responsibilities. It is structured for review by security leadership, legal, and affected business owners before formal adoption.

Hallucinated writing examples

Scenario: In an illustrative period following the SEC April 2018 cease-and-desist order on delayed breach disclosure (time), the Security Director (role) prepares a security policy draft (type) for Security, legal, and finance stakeholders (audience).

ENTERPRISE SECURITY POLICY — DRAFT

Policy title: Cyber Incident Escalation and Disclosure-Control Security Policy
Version: 1.0 (Draft)
Owner: Chief Information Security Officer
Effective date: Upon approval
Last reviewed: May 2018
Context: SEC File No. 3-18448 disclosure-control reinforcement

Purpose and Scope: This policy defines mandatory security-control and governance requirements for incident escalation, evidence retention, and cross-functional disclosure support after SEC findings regarding delayed cyber incident disclosure. It applies to teams responsible for incident response, security operations, legal coordination, and financial reporting support.

Policy Statement: The organization shall route defined incident triggers to legal and finance workflows, preserve required evidence, and maintain auditable records supporting disclosure decisions. Exception handling shall be formal and time-bound.

Roles and Responsibilities: The CISO owns policy governance; legal and finance co-own escalation and disclosure checkpoints; security operations maintains evidence controls; compliance verifies policy implementation.

Requirements: (1) Incident-severity triggers shall be escalated per approved timelines. (2) Logs and case artifacts shall be retained for disclosure and legal review. (3) Cross-functional approval checkpoints are required before external disclosure actions. (4) Exceptions must include rationale, owner, and revisit date. (5) Policy review and control testing shall occur annually or upon major legal/regulatory change.

Document-type guide: Security Policy Draft

Writing tips: Writing best practices — Security Policy Draft