Information is the core of any organization, misuse of information can lead to destruction of an organization but still every organization is not fully aware of the losses that could be caused because of the loss of information. Many organizations do not have information security in their critical area where the losses can takes place. And on the other hand security breaches takes place day to day and to recover the breaches is very expensive. Here in this document I have come to some topic which will cover the information security policy. I have design best practices of information security in the critical area for every organization, so that if they will follow the below practices it will beneficial for their information security management system