provide background about the standard is (what it requires) and how the company can benefit from implementing a formally documented information security management system (program). You should also address the standard’s requirements for policies to support the information security program.