Title: Policies and Practices for Implementing Information Security Strategies in Organizations