Communication

The organisation clearly communicates its expectations of management and employees concerning information security and clearly articulates its position regarding security incidents, events and weaknesses