Which of the following deficiencies identified during a review of an organization's cybersecurity policy should be of MOST concern?

While lacking specifics is a flaw, policies generally provide high-level direction, with detailed implementation typically covered by standards and procedures; an unapproved policy cannot enforce any specifics regardless.

Gaps against standards indicate weaknesses in content, but an unapproved policy fundamentally lacks the authority to address those gaps or enforce any remediation efforts.

An outdated policy is problematic, but even a current policy without board approval fundamentally lacks the necessary organizational backing to be truly effective or enforceable.

A cybersecurity policy must be formally approved by the highest levels of management, such as the board, to signify top-down commitment, establish its authority, and ensure it aligns with the organization's strategic objectives and risk appetite. Without board approval, the policy lacks the organizational mandate required for effective implementation and enforcement across the entire enterprise.