What is the role of a written security policy?

• A. It sets the organization's security expectations, defines authorities, and guides procedures and training
• B. It describes marketing strategies
• C. It details entertainment policies
• D. It explains only compliance requirements

Answer: (A)

The main idea here is understanding what a written security policy is supposed to achieve within an organization. A good security policy establishes the organization’s security expectations, clearly defines who has authority over security decisions, and provides the guidance for how security tasks are carried out. It serves as the formal rulebook that shapes day-to-day actions, decision-making, and responses to incidents. By laying out allowed and required behaviors, responsibilities, and the steps for handling security procedures and training, it creates consistency, accountability, and a basis for governance and compliance efforts. It also acts as a reference during audits, risk assessments, and when enforcing security controls.

The other options don’t fit because they address areas outside the purpose of a security policy. Marketing strategies and entertainment policies are not what a security policy covers, and a policy that only describes compliance requirements misses the broader function of guiding behavior, authority, procedures, and training across the organization.