Support Information Security with Organizational Policies and Programs — 12.1

A comprehensive information security policy that governs and provides direction for protection of the entity's information assets is known and current.