In APA format

An information technology (IT) security policy framework is the foundation of an organization’s information security program. Organizations use these documents to build process, determine acceptable technologies, and lay the foundation for enforcement. The security policy framework documents and their implementation express management’s view of the importance of information security.

What binds well-formed IT security policies together is a sense of shared beliefs, purpose and urgency. Within your organization these can be achieved by establishing principles that create a shared vision, by empowering others to act and by institutionalizing support processes.

• What business factor(s) do YOU think should be considered when building an organizational IT security policy framework? Why?
• What is the difference between risk tolerance vs risk appetite?
• Describe the processes needed for maintaining and updating policies and standard
• Describe one security principle in which YOU think policy writers should keep in mind when developing security policies. Why is this specific principle important?