Information Security Policy FoundationOverview An Information Security Policy and topic specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur. The Information Security Policy Foundation is a certification intended for individuals seeking to validate their knowledge of how to create an Information Security Policy in