I don’t know how to handle this Computer Science question and need guidance.

Subject: Operations Security

Discussion Topic: How do you determine if a business adheres to its security polices?