Information security policy should be maintained by designated persons or units, with the information security organization carrying out necessary evaluation and adjustment on a regular basis so as to maintain the appropriateness and effectiveness of information security policy.