What is a security policy and how should it be maintained?

What is a security policy and how should it be maintained?

• A. A casual note kept on a shared drive.
• B. Documented rules describing security requirements; should be reviewed, approved, communicated, and updated.
• C. A hardware maintenance guide.
• D. A financial budget for IT investments.

Answer: (C)

A security policy is a formal, documented set of rules and requirements that define how an organization protects its information and technology assets. It sets the purpose, scope, roles and responsibilities, required controls, and how compliance will be enforced and measured. Because it guides decisions and day-to-day security practices, it must be treated as an authoritative reference, not a casual note. Maintenance means ongoing governance: a policy owner should be designated, and the policy should receive approval from leadership. It needs regular reviews to reflect new threats, regulatory changes, and evolving technology or business processes. Updates should be communicated clearly to everyone affected, and a formal change-management process should be followed to track versions, capture approvals, and distribute the current document. This ensures the policy remains relevant and enforceable over time. A casual note on a shared drive isn’t a formal policy, a hardware maintenance guide focuses on devices rather than governing rules, and a financial IT budget covers funding rather than security requirements.

A security policy is a formal, documented set of rules and requirements that define how an organization protects its information and technology assets. It sets the purpose, scope, roles and responsibilities, required controls, and how compliance will be enforced and measured. Because it guides decisions and day-to-day security practices, it must be treated as an authoritative reference, not a casual note.

Maintenance means ongoing governance: a policy owner should be designated, and the policy should receive approval from leadership. It needs regular reviews to reflect new threats, regulatory changes, and evolving technology or business processes. Updates should be communicated clearly to everyone affected, and a formal change-management process should be followed to track versions, capture approvals, and distribute the current document. This ensures the policy remains relevant and enforceable over time.

A casual note on a shared drive isn’t a formal policy, a hardware maintenance guide focuses on devices rather than governing rules, and a financial IT budget covers funding rather than security requirements.