Living in a time of universal informatization and internetization where the information systems are indispensable in our daily lives and work of people in these systems store information they need to perform daily tasks. People design and produce information systems so that they are available at any time, from any location and any device types. To the development of the technology and systems were developed and those who would like to get hold of the data that they should not be made available, and techniques which they want to achieve their goal of alienation or damage data. These threats can come from employees of the organization itself, users of the system or of the attacker to become finance initiative, dissatisfaction or some other reason. His intentions are trying to realize in many ways depending on the type of damage that they want to lead. Today are widely available are many ways to attack the target information systems, be it on Advanced attackers who themselves made malicious software or beginners who use illegal solutions available. To protect your organization's data policy makers, policies and procedures to prevent or minimize the possibility of an attack on its information systems. In this process, which is not at all is not simple nor inexpensive important declarative and clear decision support and administration. In making the documents you need to keep the standards and recommendations of the standardization bodies and legislation, in order to better secure information systems and the information itself. Kranji contribution to the work of the Rules security policies that can be applied to a large number of organizations to the adaptation of the specifics of individual organizations.