Review of an IT security policy