Which type of policy BEST helps to ensure that all employees, contractors, and third-party users receive formal communication regarding an organization's security program?

Question

Options

• AManagement review policy
• BInformation security training policy
• CSecurity incident management policy
• DBusiness continuity management policy

• A
  4% (1)
• B
  93% (26)
• D
  4% (1)

Explanation

An Information Security Training Policy (B) is correct because its primary purpose is to mandate that all personnel - employees, contractors, and third-party users - receive formal, documented communication about the organization's security expectations, requirements, and program. It establishes who gets trained, how often, and what they must acknowledge, making it the direct mechanism for broad security awareness communication.

Why the distractors are wrong:

• A (Management Review Policy) - focuses on periodic leadership reviews of the security program's effectiveness, not on communicating it to all users.
• C (Security Incident Management Policy) - governs how to respond when something goes wrong; it doesn't address routine communication to all personnel.
• D (Business Continuity Management Policy) - covers keeping operations running during disruptions; it has no mandate around security program communication to users.

Memory tip: Think of the word "training" as a synonym for "reaching everyone." Any time a question asks about ensuring all users or all personnel receive formal security communication, training/awareness policies are the mechanism that touches the broadest audience.

No community discussion yet for this question.