A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Which of the following are required to be addressed in…

Question

Options

• AWhat is being secured
• BWho is expected to comply with the policy
• CWhere is the vulnerability, threat, or risk
• DWho is expected to exploit the vulnerability

• A
  89% (49)
• D
  11% (6)

Explanation

A well-designed security policy must define what assets are being protected (A), who is obligated to follow it (B), and what vulnerabilities, threats, or risks the policy addresses (C) - these three components give the policy scope, accountability, and purpose. Without all three, the policy lacks the clarity needed to be enforceable or actionable across the organization.

Option D is wrong because a security policy is a defensive, governance document - it is never the role of a policy to identify who will attack the organization. That concern belongs in threat modeling or risk assessments, not the policy itself.

Memory tip: Think of A, B, C as the "What, Who, Why" of policy writing - What is protected, Who must comply, and Why it matters (the risk landscape). If an answer choice puts the attacker in the policy's scope, it's always a distractor.

No community discussion yet for this question.