[Verse 1]
When you're writing policy that must be clear
Five elements make control statements appear
Start with the actor, who will take the lead
Then define the action, what they need to do indeed
The object follows, what they're acting on
Frequency tells us how often it's done
[Chorus]
Actor, action, object too
Frequency and condition make it true
Who does what to what and when
Under what circumstances, say it again
Actor, action, object too
Frequency and condition, control comes through
[Verse 2]
Information Security team takes the stage
They are the actor on this policy page
Shall review is the action, crystal clear
User access privileges, the object we revere
Quarterly timing keeps the rhythm tight
For high-risk systems, conditions make it right
[Chorus]
Actor, action, object too
Frequency and condition make it true
Who does what to what and when
Under what circumstances, say it again
Actor, action, object too
Frequency and condition, control comes through
[Bridge]
Five parts working as one design
Making sure your controls align
No confusion, no debate
When all five elements communicate
Who and what and when and where
Conditions make the context clear
[Verse 3]
Every statement needs this structure sound
Without these pieces, gaps will be found
Missing actor leaves you wondering who
Missing frequency, when is overdue
Object unclear means what's unknown
Conditions help set the proper tone
[Chorus]
Actor, action, object too
Frequency and condition make it true
Who does what to what and when
Under what circumstances, say it again
Actor, action, object too
Frequency and condition, control comes through
[Outro]
Five elements strong, your policy's complete
Actor, action, object, timing so sweet
Add the condition, now you're in control
Five parts together make the perfect whole