Kimberly Smith
INF 325 Telecommunications & Networking Concepts
Instructor: Karmaveer Koonjbearry
September 7, 2015

Discusses the Differences Between ‘Implementation’ and ‘Policy’ and Describes the Importance of Their Separation
Management defines information security policies to describe how the organization wants to protect its information assets. After policies are outlined, standards are defined to set the mandatory rules that will be used to implement the policies. Some policies can have multiple guidelines, which are recommendations as to how the policies can be implemented. Finally, information security management, administrators, and engineers create procedures from the standards and guidelines that follow the policies. This is a major flaw in the linear model because policies often change as they move through bureaucracies to the local level where they are implemented. ‘Implementation always makes or changes policy to some degree’, (Lindblom 1980). ‘Policy implementers interact with policy-makers by adapting new policies, co-opting the embodied project designs or simply ignoring new policies, hence underscoring the fact that implementers are crucial actors whose actions determine the success or failure of policy initiatives’, (Juma and Clarke 1985). Better practice implementation plans are scalable and flexible. They reflect the degree of urgency, innovation, complexity and/or sensitivity associated with the particular policy measure, and provides sufficient detail to support and inform successful implementation. One of the most important effects of the division between policy-making and implementation is the possibility for policy makers to avoid responsibility. ‘The dichotomy between policy-making and implementation is dangerous. That is because it separates the ‘decision’ from the ‘implementation’ and thus opens up ‘escape hatches’ through