The creation and enforcement of security policies. Frequently, the security of systems should be tested, and policies should be changed whenever new technology is introduced or flaws are found in currently existing security policies. Log and record keeping is vital.