## 4 Finding and Discussion  
Information Security Policy (ISP) can be defined as a set of rules, regulations, and guidelines that protect information systems from unauthorised access, use, modification, and destruction. It may also address other issues related to information security, such as computer security, data security, and network security. There are several ISP models and frameworks in the literature that are duplicated, resulting in a disorganised, unstructured, and unclear ISP field due to the duplicate policies, procedures, and processes described in these models. As a result of reviewing and analysing the literature, the authors of the present paper gained a deeper understanding of security policy practices from an ISO 27001 perspective. Then, key areas where improvements are needed were identified to ensure security policies are compliant with ISO 27001 standards and best practices. Specifically, the review conducted in this study identified the need for better policy implementation, more detailed policy documentation, improved risk assessment processes, and improved internal and external communication. Additionally, authors recognised the importance  
\begin{table}
\begin{tabular}{c} \hline Organisation \\ \hline Risk Management \\ \hline Access Control Policy \\ \hline Security Policy \\ \hline Edit \\ \hline Review \\ \hline Compliance \\ \hline Business Management \\ \hline Backup and Recovery \\ \hline Incident Response \\ \hline SETA Program \\ \hline Security Awareness \\ \hline Security Training \\ \hline Security Education \\ \hline Email Policy \\ \hline Cloud Policy \\ \hline Network Policy \\ \hline Website Policy \\ \hline Physical Policy \\ \hline Privacy Policy \\ \hline \end{tabular}
\end{table}
Table 5: Comparison of the developed ISPM practices with the ISO 27001 security controls.  
of developing a culture of security in organisations and providing adequate training and guidance to staff.  
For this purpose, the Information Security Policy Metamodel (ISPM) was developed in this study. The developed metamodel allows for the comprehensive examination of various components of ISP and development of a holistic view of the policy. It provides a structured view of the policy structure and helps to identify relationships amongst various elements. The ISPM also aids in the development of a comprehensive understanding of policies, as well as the development of more detailed policies. Furthermore, it helps to develop a more effective security posture by allowing for the identification of potential security vulnerabilities. ISPM was designed in a way to be flexible and extensible, allowing for the integration of additional security practices and the continual improvement of policies. Additionally, it was designed in a way to be easily integrated into existing information security frameworks. ISPM can help organisations develop their own effective security strategies.  
From the ISO 27001 perspective, the developed ISPM is more comprehensive than the existing information security policy models in Section 2 and Table 2. It provides a structured approach, with a detailed set of steps, which can help organisations to develop a secure information security policy, covering all important aspects of information security. It covers risk assessment, threat identification and risk management, data protection and privacy, access control and authentication, audit and logging, encryption and other security measures, and incident response. In addition, the metamodel can be used to develop a comprehensive security framework that covers all aspects of information security.