Communication

The organisation clearly communicates its expectations of management and employees concerning security requirements for all new information systems or upgrades to existing information systems