How often should the information security policy be reviewed?

How often should the information security policy be reviewed?

• A. At least annually
• B. Quarterly
• C. Monthly
• D. Only after incidents

Answer: (A)

Regular policy governance means keeping the information security policy up to date as the organization changes. The information security policy should be reviewed at least annually to ensure it still reflects current business practices, technology, threats, regulatory requirements, and lessons learned from any incidents. It should also be updated when significant changes occur, such as new systems, processes, or personnel, or after incidents, but the minimum cadence is yearly. Reviewing more often (quarterly or monthly) is not the baseline expectation, and reviewing only after incidents misses proactive alignment and ongoing control.

Regular policy governance means keeping the information security policy up to date as the organization changes. The information security policy should be reviewed at least annually to ensure it still reflects current business practices, technology, threats, regulatory requirements, and lessons learned from any incidents. It should also be updated when significant changes occur, such as new systems, processes, or personnel, or after incidents, but the minimum cadence is yearly.

Reviewing more often (quarterly or monthly) is not the baseline expectation, and reviewing only after incidents misses proactive alignment and ongoing control.