An organizational policy should be reviewed and updated on a regular basis and after a major change to the organization. A security Police should ALSO be written so that it is easily understood. If the team performing the steps required to complete it. If they cannot understand what is supposed to be done because the language is too vague or too convoluted than how are they supposed to implement the policy correctly? I agree that the policy should also be reviewed annually but perhaps the question should be re-written to say "Select the BEST answer..." and get rid of the NOT. This is a poorly written question!***