12.3.5 requires?

12.3.5 requires?

• A. Acceptable uses of the technology
• B. Explicit approval by authorized parties
• C. A method to accurately determine owner, contact information, and purpose
• D. Acceptable network locations for the technologies

Answer: (A)

The main idea here is that policy guidance must define how technology may be used. 12.3.5 requires an explicit statement of acceptable uses of the technology, which is part of a formal security policy. This helps ensure everyone knows what is allowed and what isn’t, reducing risky or prohibited behavior and giving the organization a basis to enforce the rules and train users. Think of it as setting clear, everyday boundaries for technology use so that actions don’t inadvertently create security gaps. The other options describe things that aren’t the primary focus of this requirement: approvals by authorized parties pertain to governance or change control, determining owner and contact information relates to asset management, and specifying acceptable network locations deals with where technology can operate rather than how it may be used.

The main idea here is that policy guidance must define how technology may be used. 12.3.5 requires an explicit statement of acceptable uses of the technology, which is part of a formal security policy. This helps ensure everyone knows what is allowed and what isn’t, reducing risky or prohibited behavior and giving the organization a basis to enforce the rules and train users.

Think of it as setting clear, everyday boundaries for technology use so that actions don’t inadvertently create security gaps. The other options describe things that aren’t the primary focus of this requirement: approvals by authorized parties pertain to governance or change control, determining owner and contact information relates to asset management, and specifying acceptable network locations deals with where technology can operate rather than how it may be used.