What is the first phase in the information security policy development life cycle?

(Note: If your actual options are only the three above, then the correct one in the standard framework is usually "Policy planning / Needs assessment" or "Policy planning." If that's not available, "Policy construction" may be the default in your question bank, but it does not align with ISO best practice.)

The information security policy development life cycle typically starts with a policy planning or needs assessment phase, where organizational needs, objectives, and requirements are determined before constructing the policy. Risk assessment often occurs during this initial phase to inform policy direction.

“The policy development process should start by identifying needs and requirements before constructing and implementing the policy.”

— ISO/IEC 27002:2022, 5.1; ISO/IEC 27003:2017, Clause 8.2