text: As with any type of business activity , information security should be monitored and periodically reassessed to ensure that policies continue to be appropriate and that controls are accomplishing their intended purpose .
  
  ###
  
  Once established , information security policies remain valid .