Each policy should include its own owner, monitoring plan, and enforcement plan. Policy management in general should be measured by how many policies have active owners, how often they are monitored, and how actual enforcement compares with planned enforcement, as well as how often the policy itself is reviewed and updated.
