Compiled with significant input from the private sector, the Cybersecurity Framework isn’t a prescriptive compliance document and instead gives companies significant leeway in how they use it to inform their security strategies. As a relatively new source of guidance, its implications for regulated industries aren’t clear yet.

The constantly changing cybercrime landscape paired with the speed of new technologies can make it difficult to know which skills a security administrator should focus on.

If you still think creating and maintaining a security policy isn’t necessary, you could be setting up your organization for an unpleasant surprise. Check out the top three reasons businesses need an up-to-date security policy.