You are a new member of the infosec group for a midsized consumer products manufacturing organization. After you have been there a few weeks, you are shocked to learn that the organization has not defined an AUP. You are determined to prioritize the creation of such a policy for the infosec group. What key points can you make to management to justify the necessary time and effort to make an AUP? Who else should you recruit in your efforts to sell this idea to management? Identify the key points that should be included in the AUP.