Which of the following statements about policy is FALSE?

Question

Options

• AA well-written policy contains definitions relating to "what" to do.
• BA well-written policy states the specifics of "how" to do something.
• CSecurity policy establishes what must be done to protect information stored on computers.
• DPolicy protects people who are trying to do the right thing.

• A
  9% (4)
• B
  2% (1)
• C
  5% (2)
• D
  84% (36)

Explanation

Security policy is an organizational document that defines WHAT must be protected and what rules must be followed - it is organization-centric, not person-centric. Statement D is FALSE because policy does not inherently protect individuals who are 'trying to do the right thing'; it protects the organization's information assets. A well-meaning employee who violates policy - even unintentionally - is not shielded by the existence of that policy. Statements A and C are true: policy defines 'what' must be done and establishes rules for protecting information. Note that statement B is also a common misconception - policies define 'what,' while procedures define 'how' - but D is identified as the primary false statement in this context.

No community discussion yet for this question.