Joe, a security analyst, asks each employee of an organization to sign a statement saying that they understand how their activities may be monitored. Which of the following BEST describes this…

An acceptable use policy (AUP) establishes the rules for how organizational resources may be used and explicitly notifies employees of monitoring practices, making it the primary document employees sign to acknowledge these terms.

A risk acceptance policy documents the organization's decision to accept a specific identified risk rather than informing employees about activity monitoring.

A privacy policy discloses to individuals how their personal data and activities may be collected, monitored, or shared; having employees sign this acknowledges their understanding that the organization may observe their actions on company systems.

An email policy specifically governs the use of organizational email systems and is a subset of broader policies; it does not broadly cover all activity monitoring.

A security policy is a high-level governance document defining the organization's overall security objectives and responsibilities; it is not typically what employees sign to acknowledge monitoring of their specific activities.