What it asks for. This category asks organisations to establish, communicate and enforce a cybersecurity policy. The policy should be based on organisational context, strategy and priorities, and should be reviewed, updated and communicated to reflect changes in requirements, threats, technology and mission.
In practice. A top-level policy approved by leadership sets direction and is supported by topic-specific policies and standards. Policies have owners, version control and review dates, and are communicated to staff and relevant third parties with acknowledgement tracked. Exceptions are recorded, risk-assessed and time-limited. Evidence includes approved policy documents, review history, communication and attestation records, and an exception register.
Common gaps. Common gaps are policies copied from templates that do not match actual practice, missed review cycles and no mechanism for enforcement. Exceptions are often granted informally and never revisited.