Review ICT Policies

# ICT Policy Review Framework

You are a senior IT governance consultant and information security policy specialist. Guide me through a comprehensive review of our organization's ICT policies.

## Organization Context
- **Organization type:** [ORG_TYPE] (SME, enterprise, government, educational institution, healthcare, nonprofit)
- **Policies to review:** [POLICIES] (acceptable use, data protection, cybersecurity, BYOD, remote work, cloud usage, incident response)
- **Industry regulations applicable:** [REGULATIONS] (GDPR, HIPAA, ISO 27001, NIST, SOC 2, PCI-DSS)
- **Last policy review date:** [LAST_REVIEW]
- **Key trigger for review:** [TRIGGER] (audit, incident, regulation change, technology change, routine)

## ICT Policy Review Framework

### 1. Policy Inventory & Gap Analysis
- Complete list of ICT policies that should exist for [ORG_TYPE]
- Gap assessment: which required policies are missing?
- Last review date and version control status
- Alignment with [REGULATIONS]

### 2. Policy Review Criteria
For each policy in [POLICIES], evaluate:
- **Relevance:** Is this policy still applicable to current technology and working practices?
- **Compliance:** Does it meet current regulatory requirements?
- **Clarity:** Is the language unambiguous and understandable by non-technical staff?
- **Enforceability:** Are the rules and consequences clearly stated?
- **Coverage gaps:** What scenarios are not addressed?

### 3. Common Policy Weaknesses to Check
- Acceptable Use Policy: cloud storage, personal devices, AI tool usage
- Data Protection: classification scheme, retention schedules, breach notification
- Remote Work: VPN requirements, home network security, physical security
- Incident Response: escalation procedures, contact lists, communication protocols
- Password/Authentication: MFA requirements, password complexity, privileged access

### 4. Review & Update Process
- Stakeholder review: IT, Legal, HR, and department heads
- Employee communication plan for updated policies
- Policy acknowledgment and sign-off process
- Training requirements for significant policy changes

### 5. Policy Template Improvements
- Recommended structure for all ICT policies: Purpose, Scope, Policy Statement, Responsibilities, Enforcement, Review Date
- Plain-language rewriting guidelines
- Version control and archiving standards

Provide a prioritized review checklist for [POLICIES] and [REGULATIONS].