What is considered the foundation of the security infrastructure?

• A. Information Security Policies
• B. Security Policies
• C. EISA
• D. Defense-in-Depth

Answer: (B)

Security policies establish how an organization governs and enforces security. They lay out who is responsible for what, what is acceptable, and how risk is managed, providing the rules that all security controls must follow. Because they define the organization’s security objectives, priorities, and decision-making process, they set the baseline for every control, standard, procedure, and enforcement mechanism. Without formal security policies, security measures would be inconsistent and ad hoc, making it difficult to audit, enforce, or respond to incidents. That governance framework is why security policies form the foundation of the security infrastructure. Information security policies are important but are a part of the broader security policies umbrella; defense-in-depth is a strategy for layering controls rather than the foundational governance; and EISA is not the baseline concept here.