Regular assessment and policy: Before making any changes, it is a good idea to assess the information systems within and across the company, and identify areas that need improvement. A security policy should be established to govern the development of subsequent guidelines and procedures. It is also important that ongoing assessments are carried out regularly so that existing procedures can be updated and refined to changes in working conditions and new technologies.