When reviewing an organization's information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the…

Information security policies are administrative controls established to reduce risk to an acceptable level. The primary and most fundamental basis for defining these policies is a formal risk management process. This process involves identifying critical assets, assessing threats and vulnerabilities, and evaluating the potential impact of adverse events. The resulting understanding of the organization's specific risk profile allows for the creation of targeted, relevant, and effective policies. Policies developed without a risk-based foundation may be misaligned with business objectives, fail to address the most significant threats, or result in the inefficient allocation of security resources.

B. An information security framework provides a structure for security controls, but the selection and tailoring of that framework should be guided by the organization's specific risk assessment.

C. Past information security incidents are a valuable input for risk assessment but relying on them primarily creates a reactive, rather than proactive, security posture.

D. Industry best practices are useful references, but they must be adapted to the organization's unique context and risk appetite, which is determined through a risk management process.

---

1. ISACA. (2019). CISA Review Manual

27th Edition. Section: Chapter 4

Information Systems Operations and Business Resilience

Part A: Information Systems Operations. The manual emphasizes that the information security policy is a key element of security governance and that it should be based on a risk assessment to ensure it addresses the organization's specific threats and requirements.

2. National Institute of Standards and Technology (NIST). (2011). Special Publication 800-39

Managing Information Security Risk: Organization

Mission

and Information System View. Section 2.2

"The Tiers in the Risk Management Hierarchy

" p. 8. This publication describes how risk-based decisions

including the establishment of policies

are made at the highest tier of the organization to guide all subsequent security activities.

3. International Organization for Standardization. (2022). ISO/IEC 27001:2022 Information security

cybersecurity and privacy protection — Information security management systems — Requirements. Clause 6.1.2

"Information security risk assessment

" and Clause 6.1.3

"Information security risk treatment." The standard mandates a risk assessment process to identify necessary controls

which are then documented and implemented through policies and procedures. This directly links policy creation to the outcome of risk management.