There is little information in security policy literature about quality measurement or improvement ofpolicy. Instead, the literature concentrates on suggesting what should, or should not be included in asecurity policy (McMillan 1998, ...