Which term refers to the formal guidelines and rules governing security across the organization?

• A. Information Security Policies
• B. EISA
• C. Security Policies
• D. Defense-in-Depth

Answer: (C)

Security policies are the formal guidelines and rules that establish how security is managed across the organization. They express management’s intent, define who is responsible for what, and set the high-level rules employees and systems must follow. They cover areas like acceptable use, access control, data protection, incident response, and compliance with laws and regulations. This makes them the overarching governance document for security, guiding the creation of standards, procedures, and controls throughout the organization.

Information security policies are closely related but focus specifically on information security rather than all security domains across the whole organization. EISA refers to an architecture framework, not the governing set of rules. Defense-in-Depth is a security strategy describing layered controls, not a policy document.