How to Complete a Risk Assessment in 5 Days or Less

Gap Analysis  ◾  109

Table 5.7 Gap Analysis Example 3

5 – Security policy

5.1 – Information security policy

To provide management direction and support for information security in accordance with business requirements and relevant

laws and regulations. Management should set a clear policy direction in line with business objectives and demonstrate

support for, and commitment to information security through the issue and maintenance of an information security policy

across the organization.

Class C

ontrol Description PCI — “PCI” DSS Big Company

5.1.1 Information

security policy

document

An information security policy

document should be approved by ...