Includes a document that outlines an organization's anti-virus policies. It lists products, configuration settings, update schedule, and anti-virus enforcement policies. The organisation should review this policy document at least every six months to compare the company's security posture with the current threat landscape.