Which of the following is true about security policies and procedures?

Which of the following is true about security policies and procedures?
A . They should be regularly reviewed and updated to reflect changing threats and technologies
B . They should only be accessible to the IT department.
C . They should be documented once and never changed.
D . They should be kept confidential and not shared with employees.

View Answer

Answer: A

Explanation:

Option 1: Correct: Security policies and procedures should be regularly reviewed and updated to ensure they align with changing threats and technologies. This helps to maintain the effectiveness of the policies and processes.

Option 2: Incorrect: Security policies and procedures should be accessible to relevant employees and stakeholders, not restricted only to the IT department. It is important for everyone to understand and adhere to the policies and procedures.

Option 3: Incorrect: Security policies and procedures should be regularly updated as needed, not documented once and never changed. The changing threat landscape and evolving technologies necessitate the periodic review and update of security policies and procedures.

Option 4: Incorrect: Security policies and procedures should be communicated and shared with employees to ensure everyone understands and follows them. Keeping them confidential and not sharing them would hinder their effectiveness.