During an information security audit of a mid-sized organization, an IS auditor notes that the organization's information security policy is not sufficient. Wha...