The purpose of an information risk management policy is to protect the organization’s assets from potential damage caused by cyber-attacks, data loss, natural disasters or other threats.
An effective IRM policy will include measures for protecting both tangible and intangible assets including: physical security such as fire protection, alarm systems and video surveillance; technical protection such as password requirements and encryption devices; human resources protections such as training programs on how to handle emergency situations safely. It also may include procedures for restoring service after a disaster has occurred.