ITPEC IP April 2018 Question 45

The top-level policy is unified across the organization — departments may take different measures, but they all follow one basic policy.

An information security policy is layered. The basic (top-level) policy states management's intent, objectives and principles for the whole organization. Below it, rules (standards) say what must be done and procedures say how; these can differ by department according to its risks and work. Because the basic policy is the organization's single statement of direction, it is the same for every department.

Answer (d)

Why not others:

• •(a) — management sets, approves and supports the policy; the detailed rules and procedures are carried out by the departments and staff responsible, not by management itself
• •(b) — the basic policy may be published to show the organization's stance, but rules and procedures contain internal details that could help an attacker, so they are kept inside
• •(c) — the top-level policy expresses the organization's own objectives and must reflect its business and risks; it cannot simply be taken from an industry model

Key rule: One basic policy for the whole organization sits at the top; the rules and procedures beneath it are tailored to each department and become more specific, and less public, at each level down.

Security · AI-written, may contain errors