An effective information security policy should not have which of the following characteristic?

The correct answer is B. Be designed with a short- to mid-term focus. A good information security policy should be designed with a long-term strategic focus, not a short- to mid-term focus. Short- or mid-term policies require frequent rewrites, create instability in the security program, and may not remain aligned with the organization's enduring…

Submitted by jordan8· Apr 18, 2026Security Concepts and Practices

Question

Options

AInclude separation of duties
BBe designed with a short- to mid-term focus
CBe understandable and supported by all stakeholders
DSpecify areas of responsibility and authority

How the community answered

(43 responses)

A
2% (1)
B
86% (37)
C
7% (3)
D
5% (2)

Explanation

A good information security policy should be designed with a long-term strategic focus, not a short- to mid-term focus. Short- or mid-term policies require frequent rewrites, create instability in the security program, and may not remain aligned with the organization's enduring mission. All the other options are desirable characteristics: separation of duties reduces fraud and error risk; being understandable and stakeholder-supported ensures compliance; and specifying areas of responsibility and authority ensures accountability. A short- to mid-term focus is the only listed characteristic that would weaken, not strengthen, a security policy.

Topics

#Information Security Policy#Policy Characteristics#Security Governance#Policy Design

Community Discussion

No community discussion yet for this question.

Full SSCP Practice