Information security is often about technology. But information security starts with the information security policy in the organization. The information security policy states the requirements the organization sets for security....