SG-01—Policy and Standard Review

>Control Description

Organization's policies and standards are periodically reviewed, approved by management, and communicated to Organization personnel.

Theme

Process

Type

Preventive

Policy/Standard

Information Security Management Standard

>Implementation Guidance

1. Ensure that the organization's policies and standards are well-defined, documented and communicated with relevant personnel. 2. Ensure that these policies and standards are reviewed periodically and are approved by the management.

>Testing Procedure

1. Inspect organization's Policy to determine whether requirements for periodic reviews, management approval, and communication of policies and standards are defined. 2. Inspect a sample of organization's policies and standards to determine whether they are documented, periodically reviewed, and approved by management 3. Inspect the corporate intranet or email communication sent to employee that validates these policies are communicated within the organization.