We recommend the Department 1) retire or supersede IT security policies and procedures on the Department Directives website in a timely manner; and 2) use various communication mediums (e.g., The Federal Chief Information Security Officer Council, Information System Security Manager meetings, etc.) during the policy clearance process to inform employees, contractors, and other stakeholders of required practices and procedures.