explain first the policy concept, then the CIA triad that must be followed for make the policy. Afterward, the policy must mention the approved staff (how are allowed to read modify the data), the conditions of password creations, how STM employee will login in STM company, the changes that done in the firewall, how to measure the data breaches in data, and the physical security.