The major objectives of a security assessment are to validate conformance to existing security policies, standards and procedures; identify inadequacies and examine the effectiveness of the existing policies, standards, guidelines and procedures; identify and understand potential vulnerabilities; review existing security controls associated with operational, administrative and managerial functions and ensure compliance to minimum security standards; and provide recommendations and corrective actions for improvements.

The purpose of this policy is to develop a consistent method for scheduling and managing company IT security assessment processes.