What defines a security policy?

• A. A document focusing only on user access rights
• B. A formal document outlining security requirements and procedures
• C. A strategy for implementing network hardware
• D. A guide for configuring firewalls

Answer: (B)

A security policy is fundamentally a formal document that establishes the framework for an organization's approach to securing its information and technology assets. It outlines the security requirements that must be met and the procedures to be followed to achieve compliance with those requirements. This document is crucial for defining the expectations for security practices across the organization, detailing roles and responsibilities, and providing guidance on how to respond to security incidents.

In contrast, focusing solely on user access rights or restricting it to strategies for implementing hardware or configuring firewalls does not capture the broader scope of a security policy. While aspects like user access or firewall configurations can indeed be components of a security policy, they do not encompass the entire strategy or framework needed to address security comprehensively. A security policy aims to provide a holistic view of security measures that incorporate all aspects of protecting an organization’s information resources.