The information security policy sets the direction for the consistent management of CGI security risks, and provides guidance for the establishment of security controls required to adequately protect CGI and client information assets.