Why Organizations struggle with InfoSec Policies and Standards.
Although InfoSec Policies and Standards are a primary tool for communicating security expectations, for many organizations, they are more a source of confusion, and worse, they can increase the organization’s liability. Employees are forced to sift through bloated, complex, and frequently contradictory documents and then deduce what requirements apply to them in their particular role and circumstance. Neither security managers nor internal audit can confidently attest they meet minimum regulatory compliance and risk management practices.
edgile-end-the-struggle-with-infosec-policies-and-standards