Which sub-requirement requires establishing, documenting, and distributing security policies and procedures?

Which sub-requirement requires establishing, documenting, and distributing security policies and procedures?

• A. Requirement 12.5.2
• B. Requirement 12.5.1
• C. Requirement 12.4
• D. Requirement 12.3.8

Answer: (B)

The key idea tested is that a formal security policy and its procedures must be created, recorded, and shared with everyone in the organization. This ensures all personnel know the rules and how to behave securely. The sub-requirement that specifies establishing, publishing, maintaining, and disseminating a security policy addressing information security for all personnel directly matches that idea. It explicitly calls for creating the policy, putting it in writing, keeping it up to date, and distributing it so staff can access and follow it. Because this is the exact wording that ties policy creation to documentation and wide distribution, it best fits the question. Other sub-requirements in this area cover different aspects of the overall security program—such as ongoing policy updates, or other security controls—without repeating the precise mandate to establish, document, and disseminate the policy to all personnel. Understanding this helps you see why establishing and communicating the formal security policy is the foundation that supports the rest of the requirements.

The key idea tested is that a formal security policy and its procedures must be created, recorded, and shared with everyone in the organization. This ensures all personnel know the rules and how to behave securely.

The sub-requirement that specifies establishing, publishing, maintaining, and disseminating a security policy addressing information security for all personnel directly matches that idea. It explicitly calls for creating the policy, putting it in writing, keeping it up to date, and distributing it so staff can access and follow it. Because this is the exact wording that ties policy creation to documentation and wide distribution, it best fits the question.

Other sub-requirements in this area cover different aspects of the overall security program—such as ongoing policy updates, or other security controls—without repeating the precise mandate to establish, document, and disseminate the policy to all personnel. Understanding this helps you see why establishing and communicating the formal security policy is the foundation that supports the rest of the requirements.