(Note: If your actual options are only the three above, then the correct one in the standard framework is usually " Policy planning / Needs assessment " or " Policy planning. " If that ' s not available, " Policy construction " may be the default in your question bank, but it does not align with ISO best practice.)
The information security policy development life cycle typically starts with a policy planning or needs assessment phase, where organizational needs, objectives, and requirements are determined before constructing the policy. Risk assessment often occurs during this initial phase to inform policy direction.
“The policy development process should start by identifying needs and requirements before constructing and implementing the policy.”
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit