Which of the following is the BEST source of information for an IS auditor to use when determining whether an organization's information security policy is adeq...