documentation of all processes, both of which are required for certification. In our system, privacy does not exist. As I said, whomever wants to can take the codes wherever they like. Information Security Management Effectiveness Case A's upper management, managers, and staff all agree that information security is extremely important, yet the matter has been given relatively little attention. There are no established procedures or mechanisms for ISM since the company lacks a formal information security policy or principles. Employees lack knowledge of the various threats to information and information assets due to a lack of training or awareness campaigns. During the course of the interview, it became clearly obvious that data loss occurs frequently as a result of carelessness and unwillingness, and that this has a negative impact on the organization's productivity as a whole. Such accidents have occasionally caused delays in project execution, which has had negative result including financial losses, lost revenue, and even lost clients. The organization needs a risk assessment and management plan, but it does not currently have one... Accountabilities need to be established, and not just orally but also in writing... Now you have to create a Information security policy considering the above and following points: - 1. Purpose 2. Audience and Scope 3. Information Security Objectives 4. Authority and access control policy 5. Classify your data by security level or break down your data in hierarchy 6. Data Support and Operation 7. Components to include in security training 8. Responsibilities, rights, and duties of personnel