3.1 Establish an information security policy.