12558 evsjv‡`k †M‡RU, AwZwi³, GwcÖj 6, 2014 (2) Preparing Strategy It is important to understand the best practices to prepare own strategy but it is not always rational to adopt the best practices only. Accepting best practices only may leave the policy strategy unworkable and unrealistic. So, it’s always recommended to prepare strategy blending the real world and best practices as required by an agency. Information security strategy has the following stages: (a) Stage 1: Objective There must be an objective for an organization/agency to adopt information security strategy. For most organization/agency the objective is to safeguard their information from threats in the cyber space. Threats of information theft or loss may disrupt the goal and productivity of an agency. So the agencies should set their objective to protect their information from threats. (b) Stage 2: Understanding Before starting formulation of the security policy for an agency, it is required to have a thorough understanding of the agency. It is also required to consider the goals and direction of the agency. The policy that is going to be developed must also conform to existing policies, rules, regulations and laws that the agency is subject to. In this stage, before developing the policy, it is also required to gather information to identify the information assets; to identify the risks, vulnerabilities & threats; to identify potential safeguards & controls with associated cost and percentage of risk reduction; and to redefine roles and responsibilities. (c) Stage 3: Plan With the gathered information of stage two (2) and considering the objective the agency shall prepare its security policy in this stage. This stage may include procedures, standards, guidelines etc along with the policy. While preparing the security policy it is recommended that the agency should take assistance and check compliance with ISO/IEC 27002: Code of Practice for Information Security Management. While developing the policy, the agency should consider the location of their information asset, whether they are putting it inside their domain or outside. The government agency must keep their information asset inside the country. And it is recommended that the government agencies should keep their information asset in the National Data Center hosted in BCC. Before putting the policy in action, it is recommended to organize consultation among the implementer and stakeholders of the policy. Such consultation will help produce effective security policy.