What document specifies how an organization handles information?

The document that specifies how an organization handles information is typically known as an Information Security Policy (ISP) or Data Management Policy. This policy outlines the guidelines and procedures for managing, protecting, and processing information, including data privacy, access controls, and incident response. It serves to ensure compliance with legal and regulatory requirements while safeguarding sensitive information.