Focuses on creating, implementing, and managing effective information security policies.