Security policies and procedures are essential for implementing IT security management:
authorizing security roles and responsibilities to various security personnel; setting rules for
expected behavior from users and security role players; setting rules for business continuity
plans; and more. The security policy should be generally agreed to by most personnel in the
organization and have support from the highest-level management. This helps in
prioritization at the overall organization level. The IT security processes are essentially part
of an organization’s risk management processes and business continuity strategies. In a
business environment marked by globalization, organizations have to be aware of both
national and international rules and regulations. Their information security and privacy
policies must conform to these rules and regulations.