evsjv‡`k †M‡RU, AwZwi³, GwcÖj 6, 2014 12551 (28) Risk management: Coordinated activities to direct and control an organization with regard to risk. (29) Risk treatment: Process of selection and implementation of measures to control or minimize risk. (30) Social engineering: Obtaining information from individuals by trickery. (31) Spoofing: A form of masquerading where a trusted IP address is used instead of the true IP address as a means of gaining access to a computer system. (32) Third party: That person or body that is recognized as being independent of the parties involved, as concerns the issue in question. 5. Objective (1) Information is an important asset for an agency as well as for a state. Protecting information is vital to establish and maintain trust among government, citizen and business entities. Information security is the process, involved with the people and technology of an agency, by which that agency protects and secures its information. Information Security Policy defines set of rules and control mechanism to protect information against attacks or threats or misuses or damage or unauthorized access. (2) The objective of this guideline is a. to help agencies of the Government of Bangladesh to understand the nutshell of Information Security, b. to define the methodology to prepare Information Security Policy, c. to give them proper guidance to implement Information Security Policy. 6. Scope All government, semi-government, autonomous agency or public limited company in Bangladesh who wants to prepare their Information Security Policy document, can use this guideline. This is a baseline for them to prepare their policy to protect their information. Any private organization inside Bangladesh can also adopt this guideline. 7. Information Asset (1) This section will assist the key members of an agency to redefine their idea on agencies information/data. It’ll help them to understand how to define different states and classify their information asset. It will also help setting ownership and custody for different information asset. As a result an agency can safeguard the information asset according to the defined roles and responsibilities.