Take the following as truth: As with any type of business activity, information security should be monitored and periodically reassessed to ensure that policies continue to be appropriate and that controls are accomplishing their intended purpose.
Then the following statement: "A good practice is to revisit each policy every 3 years." is true, false, or inconclusive?