Communication

The organisation clearly communicates its expectations of management and employees concerning information security management and clearly articulates its position regarding internal and external threats