Purpose This paper aims to develop an effective information security policy (ISP), which is an important mechanism to combat insider threats. Design/methodology/approach A general framework based on the Nine-Five-circle was proposed for developing, implementing and evaluating an organisation's...