Information security policies should be reviewed:
by stakeholders at least annually
by the CISO when new systems are brought online
by the Incident Response team after an audit
by internal audit semiannually
Submit