What is information security policy? Why it is critical to the success of the InfoSec program? Of the controls or countermeasures used to control InfoSec risk, which is viewed as the least expensive?
What are the primary costs of this type of control? List and describe the three challenges in shaping policy.