Policies and procedures for information security and cyber security shall be created, documented, reviewed, approved, and updated when changes occur.
An organization-wide information security and cybersecurity policy shall be established, documented, updated when changes occur, disseminated, and approved by senior management.