What is the importance of written security policy?

Written policy is essential to a successful cybersecurity program.  Without it, employees can misbehave and get away with it.  Response and recovery times in the event of a cyber incident will be drastically longer.  The mindset of leadership will not be set in stone.  Policy guides employee behavior, establishes leadership’s attitude toward cybersecurity, and addresses how data is to be stored, processed, and protected.