12.1.3A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and current

Defined Approach Requirements:

The security policy clearly defines information security roles and responsibilities for all personnel, and all personnel are aware of and acknowledge their information security responsibilities.

Defined Approach Testing Procedures:

12.1.3.a Examine the information security policy to verify that they clearly define information security roles and responsibilities for all personnel.

12.1.3.b Interview personnel in various roles to verify they understand their information security responsibilities.

12.1.3.c Examine documented evidence to verify personnel acknowledge their information security responsibilities