Designing an effective information security policy for exceptional situations in an organization: An experimental study