Information security program endeavors to ensure that the organization’s information and its processing resources are available when authorized users need them. Universities which are vulnerable have formulated Information security policy, which among things address security concerns. Such institutions make use of Encryption System. Encrypting such files at least helps protect institutions with physical security policy, digital rights management systems which prevent unauthorized use.The study aimed at assessing the implementation level of information security policy in universities in Uganda and recommend on the areas where they are not being implemented. The population of study comprised 164 staff members from seven Universities. Findings showed on average most of the policies were being implemented like policy on Access control, policy on acceptable use of workstations in their Institutional and policy on acceptable use of wireless devices except policy on Bring Your Own Device to be used at the Institution and Data destruction policy among others which were partly implemented