Find an example of a general information security policy. The policy could be for the University of Canberra or another organisation with which you are familiar. is this an internal policy, aimed at the staff and internal practices of the organisation, or is this more of an external facing policy aimed at the customers and clients of the organisation? how easy can this policy be found on the organisations website (make sure your initial search is not based on prior knowledge of the policy title)? Do you think the prominence of the policy within the organisation will make any difference to its adoption by members of the organisation? does the policy make reference to any information security standards, or other security models? is a risk management approach evident in the the policy? What are the key features that provide assurance for your answer to this question? does it connect with other information security policies, such as system-specific policies, or issue-specific policies? does the policy have a review and update cycle and is there any evidence that this has been applied? are there any other issues that stand out as being significant with this policy? from an overall perspective, does the policy appear to be adequate for the context in which it is operating?