Out of all the homework I did this week, I was very intrigued by the various different types of policies. If I had to nail down a good policy type, I'd say the issue specific type. First, they describe the technology that is discussed in the policies and they mention what problems could arise that would necessitate the need for the policy.

Could these types of policies leave gaps? Possibly. I can recall a story about a hospital that had identity theft of patient information. The perps would view patient information in the course of their routine work but then would use it to open fake accounts. The institution could not have foreseen that employees would steal patient information. So, in a situation like this would an issue policy forbidding the unauthorized access of information be applicable?

Not really because they had to see the patient's social security number. A new policy would need to be created to mention that any illegal use of patient information would be prosecuted.

Unfortunately, the mentality of our society dictates the need to craft a policy for any type of foreseeable problem.