To determine whether the agency has developed and communicated a comprehensive information security policy covering the application, or equivalent document, as required by State Policy. This should include:#Procedures#IT