Which of the following is NOT a component of a complete security program?

• A. Isolated physical barriers only
• B. Incident response planning
• C. Policies
• D. Risk assessment

Answer: (A)

A complete security program relies on a layered approach that combines policies, risk assessment, incident response planning, and physical controls. Focusing on isolated physical barriers only leaves out governance, threat identification, and prepared response steps. Policies establish rules and procedures, risk assessment identifies what to protect and where, and incident response planning provides a clear course of action when events occur. Without these elements, the program isn’t capable of guiding behavior, prioritizing protections, or handling incidents effectively. So the description of isolated physical barriers only is not a component of a complete security program.