A formal security policy can provide an effective means of protecting an organisation’s computer-based information systems against theft, damage and other hazards.

(a) Provide an overview of the areas that will be outlined by a typical formal security policy document.

(b) Describe the ways in which a formal security policy can help to protect an organisation’s computer-based information systems.

(c) A number of factors will determine whether or not a security policy works effectively.

Using relevant examples, provide a brief discussion of some of these factors.