Which statement best describes a well-implemented security policy's scope?

• A. It is a one-time document with no updates.
• B. It focuses only on cybersecurity.
• C. It defines acceptable use, roles, responsibilities, and controls.
• D. It is optional for operations.

Answer: (C)

A well-implemented security policy sets clear boundaries for action by outlining who it applies to, what resources and activities are covered, and which controls are in place to manage risk. The best statement captures this scope by including acceptable use, the roles and responsibilities of people across the organization, and the controls that enforce security. Acceptable use defines what is allowed and what isn’t in terms of handling systems and data, which helps prevent risky behavior. Defining roles and responsibilities ensures accountability, so everyone knows who is answerable for security decisions and incident response. specifying the controls—such as access management, monitoring, and governance measures—translates policy into concrete protections and actions.

A policy that is a one-time document with no updates would quickly become outdated as technology, threats, and business needs evolve, so it wouldn’t truly define an effective scope. Limiting the policy to cybersecurity ignores the broader security landscape, including physical security, data handling, and compliance. Making the policy optional would undermine consistency and enforcement across operations.