The purpose of this study is to extend the legacy threat-vulnerability model to incorporate human and social factors. This is achieved by presenting the dynamics of threats and vulnerabilities in the human and social context. We examine costs and benefits as they relate to threats, exploits, vulnerabilities, defence measures, incidents, and recovery and restoration. We discuss privacy concerns and the implications of implementing employee surveillance technologies and we suggest a framework of fair practices which can be used for bridging the gap between the need to provide adequate protection for information systems, while preserving employees' rights to privacy. Organizations have to prioritize the security of their computer systems in order to ensure that their information assets retain their accuracy, confidentiality, and availability. While the importance of the information security policy in ensuring the security of information is acknowledged widely, there has been little empirical analysis of its impact or effectiveness in this role.