Security policies and operational procedures for security monitoring and testing must be documented, in use, and known to all affected parties.

Security policies and operational procedures for security monitoring and testing must be documented, in use, and known to all affected parties.

• A. Not Documented
• B. Documented But Not Used
• C. Optional
• D. Documented, In Use, And Known

Answer: (D)

The essential idea is that security policies and procedures for monitoring and testing must not just exist on paper; they must be put into practice and shared with everyone who could be affected. Documented means there is an official, accessible statement outlining the controls, responsibilities, and expectations. In use means those procedures are actually performed during operations, not ignored or postponed. Known to all affected parties means training and awareness so people understand what to do and can follow or enforce the procedures. If any of these elements is missing, gaps appear: without documentation there’s no standard to follow; without use the controls aren’t being applied; without being known, people won’t act or respond correctly. So the best answer is the one that reflects all three: documented, in use, and known.

The essential idea is that security policies and procedures for monitoring and testing must not just exist on paper; they must be put into practice and shared with everyone who could be affected. Documented means there is an official, accessible statement outlining the controls, responsibilities, and expectations. In use means those procedures are actually performed during operations, not ignored or postponed. Known to all affected parties means training and awareness so people understand what to do and can follow or enforce the procedures. If any of these elements is missing, gaps appear: without documentation there’s no standard to follow; without use the controls aren’t being applied; without being known, people won’t act or respond correctly. So the best answer is the one that reflects all three: documented, in use, and known.