information security policy can be broadly defined as statements by an organization
providing guidance about information system security related responsibilities, rules, and guidelines which prescribe how the IS
resources are used properly and in a secure way