Devising a network security policy can be complex because a rational policy requires an organization to assess the value of information.

• 设计安全策略是复杂的，因为一个合理的安全策略需要组织去评估信息的价值。