SANS Incident Handler's Handbook and PICERL Methodology P-a: P-a Written security policy that tells staff what is expected and lets the team judge whether an incident occurred

The organization keeps a written policy of principles, rules and practices that serves as the reference for deciding whether an incident has happened; a login banner, worded for local privacy law, can warn users that activity is monitored and misuse may carry civil or criminal penalties. Without clear policy the organization is exposed legally, for example to wrongful dismissal claims over behaviour no policy prohibited.