Communication

The organisation clearly communicates its expectations of management and employees concerning system vulnerabilities and clearly articulates its position regarding fixing or patching vulnerabilities identified