evsjv‡`k †M‡RU, AwZwi³, GwcÖj 6, 2014 12559 (d) Stage 4: Implementation After preparing the policy and other supporting procedures or guidelines, the agency shall educate its personnel and distribute these to all its implementers (management, BOD, employees etc.) and take their agreement that they read & understood the policy and agreed to comply with it. The key to acceptance and compliance with security policies is education. Educating employees on the need for security and keeping them involved in the policy development process is important to keep them from finding ways to avoid policies and rendering them ineffective. Seminars and awareness campaigns help to educate the importance of security, especially on password selection, screen locking, document labeling, and physical security. Helpdesk in the preliminary stage for successful implementation may also be introduced. (e) Stage 5: Check Compliance It is always recommended that the agency must develop a method to measure compliance with the policy and check compliance in a periodical basis. This compliance method may include the formation of auditing team to ensure that the policy is enforced. The auditors who are responsible for monitoring compliance with the security policy should be independent of the persons implementing the policy. The policies must be enforced in a strictly manner and noncompliance of the policy is punishable. (f) Stage 6: Monitoring & Review It is important to have monitoring and review mechanism for future improvement since new threats are being discovered as time passes by. Monitoring & review includes changes in the organization resulting in new threats. Security controls have to be modified as necessary to mitigate any new threat introduced. Training is vital issue that might need to arrange for performance improvement. As time goes by, it is crucial to maintain the relevancy of the security policies. New policies may be added when necessary. (3) Actions according to this section In this section, the strategy for information security is defined. It is the whole life cycle for an agency to work out to develop an Information Security Policy so is to successfully protect their information assets. The stages defined in this section must be followed by agencies to safeguard their valuable information from threats. Actions in previous section (section 7.9) are part of the stages in the strategy defined earlier. The users of this policy guideline are requested not to create any confusion on what to do first. The users, who want to prepare information security policy for their agencies, should start with the stages defined in section 8.1. All other sections are to assist completing these six (6) stages.