How often should organizations update their security management policies?

Organizations should review and update their security management policies at least annually. They should also update policies when significant changes occur in their operations, technology, or threat landscape. Regular updates keep policies relevant and effective in protecting organizational assets against new and evolving threats.