The information security manager discovers that the organization's security policy set has not been reviewed in three years, during which the company adopted remote working and moved key systems to cloud services. What should be done?
Select an answer to reveal the explanation.
Short Explanation
A policy set is like a house's wiring diagram: if you've added two rooms and never updated it, it's lying to you. You review it now and set up regular plus change-triggered reviews so it doesn't drift again.
Full Explanation
Policies must remain aligned with the business, its technology and its obligations. Remote working and cloud adoption change how information is accessed, where it is stored and who manages the infrastructure, so policies written before those changes may be incomplete or inaccurate. The appropriate response is to review the set now and to establish a governance mechanism that schedules periodic reviews and triggers additional reviews when significant changes occur in the business, technology, threats or regulations. Rewriting everything from a framework template discards content that may still be valid and imposes generic wording that may not reflect the organization; review should determine what needs to change. Waiting for an audit hands responsibility for policy currency to assurance functions and leaves outdated policies in force in the meantime; maintaining policy is a management duty. Allowing each department to review only the policies affecting it on its own schedule fragments ownership, produces inconsistent results and leaves organization-wide policies without coordinated review. Exam caveat: departments should still be consulted during review, because policies must be workable for those who follow them. Operational check: confirm each policy records an owner, a last-review date and a next-review date, and that change management prompts policy review when relevant.