How to create a memo on the methodology of working with information in order to improve information security?

Question

Documentation

I work as a part-time all-in-one admin in a budget organization that has something to do with sports. Number of computers ~50pcs. The technical side of the office is a complete mess. The level of users is below average.
Issued the following task:
In accordance with the Federal Law of July 27, 2006, No. 149-FZ "On Information, Information Technologies and Information Protection". Develop an information memo on the methodology for working with information in order to ensure its protection from unauthorized access, destruction, modification, blocking, copying, distribution, and restricted access.
As for computers, I can do a lot of things with them, but I have trouble with laws and papers. Please tell me what should be written in such a "memo" ? What would be the best way to write such paper?

Answer 1

Of the latest regulatory documents, Orders of the FSTEC No. 17 and No. 21 of 2013 on the protection of personal data that do not contain state secrets stand out for the better. At the end of both Orders there is a matrix of what should be provided in a government institution (No. 17) and in a commercial (No. 21) institution. It is possible to completely formulate requirements, starting from these orders.
Another way is to take the requirements of any bank for the workplace of the Bank-Client system.
Or study this resource: www.securitypolicy.ru/index.php/%D0%97%D0%B0%D0%B3...

Answer 2

If you endure until the "post-holidays", then I can take such a memo at work and throw it off as an example. it is under Gazprom, but the compilation structure is the same. Yes, and everyone refers, when compiling such documents, to the same orders of the Ministry of Internal Affairs. I remember by heart only 78-145.93 of the Ministry of Internal Affairs - this is about providing engineering safety equipment. Your topic is somewhere in that direction