As a new member of the IT department you have noticed that confidential information has been leaked several times. This may damage the reputation of…

A structured approach to information security management, as defined by frameworks like ISO/IEC 27001, is a top-down process. The first step is to establish governance and management direction. Formulating a policy achieves this by defining the organization's objectives, scope, and commitment to information security. This policy provides the necessary authority and framework for all subsequent activities, such as risk assessments, the appointment of security personnel, and the implementation of specific procedural or technical controls like access control and encryption. It ensures that all security measures are aligned with business objectives and have clear management support.

A. Appointing security staff is a step that follows the establishment of a policy, which would define the need for and responsibilities of such roles.

B. Encryption is a specific technical control. It should be selected and implemented based on a risk assessment that is guided by the overall security policy.

D. An access control procedure is a detailed operational document. It is created to enforce the principles laid out in a higher-level access control policy.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Section 5.2, "Policy": This clause mandates that "Top management shall establish an information security policy..." This is part of Clause 5, "Leadership," which is a foundational component that must be in place before planning (Clause 6) and implementing controls (Clause 8). This establishes policy formulation as a primary step.

2. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers.

Chapter 11, "Getting Started: The ISMS Implementation Project": The book outlines the project initiation phase, stating, "The first deliverable from the project will be the top-level information security policy... This policy is the foundation on which the entire ISMS is built." (p. 145).

3. University of London, Royal Holloway. (n.d.). MSc in Information Security Courseware.

Module: Security Management: Course materials consistently teach that the information security governance framework begins with the creation of a high-level policy. This policy acts as the charter for the security program, from which standards, procedures, and guidelines are derived. The hierarchy is always Policy -> Standard -> Procedure.