[Music] this is the third video on establishing context in our site security risk assessment series your organization's security policy represents the very foundation of what you're doing when creating a site security risk assessment and there are four elements you should use from the policy to help scope your assessment number one what the organization wants security to do the overall objective and number two what it is protecting what it is protecting it from and four how they are protecting it so firstly in terms of the overall security objectives most companies will say that they want to create a safe environment for their people to work in or they'll have another specifically stated goal that will help you identify the expected level of risk acceptance and from that how much and which mitigation you should suggest and secondly what is the organization protecting usually you can expect that people and assets are mentioned but also look for words like information processes integrity of reputation now these indicate the scope of your assessments what potential threats you should be included and who you need to lie is with internally and externally and then thirdly does the policy mention any specific threats or characteristics of the environments it operates in that you need to include in your assessment and then finally the how gives you input into the overall governance processes of security you know who has what responsibilities and who will decide and ultimately pay for the outcome of your assessment this is also an input to your stakeholder analysis the whole will further reveal of their any standards you need to be aware of for example risk categorization of sites minimum requirements or non security requirements such as industry standards or legislation take a look at our security policy worksheet and let us know what you think on LinkedIn thank you for watching we'll see you for our next video on the situational analysis [Music] you