A security policy is a rigid set of rules that must be followed explicitly in order to be effective.

This statement is false because while security policies define critical boundaries and requirements, they often need to be flexible enough to accommodate evolving technologies, business needs, and threat landscapes, rather than being an entirely inflexible set of explicit rules.

Security policies are foundational documents that define an organization's security posture and requirements, but they are not always rigid and allow for interpretation and adaptation to different situations and technologies. While policies set boundaries, procedures and standards provide the explicit, detailed steps.