A formal document that defines the security program's scope, responsibilities, and objectives.

• A. Procedures
• B. Policies
• C. Standards
• D. Guidelines

Answer: (B)

The formal document that defines the security program's scope, responsibilities, and objectives is a security policy. A policy provides the organization's high-level direction and authority for information security, outlining what must be accomplished, what areas are covered, and who is responsible for enforcing and managing the program. It is mandatory and approved by senior management, serving as the guiding framework for all security activities.

This distinguishes it from procedures, which lay out the specific steps to implement the policy; standards, which set concrete criteria and controls that must be met; and guidelines, which offer recommended practices that aren’t strictly mandatory. For example, a policy might state that access to confidential data must be restricted to authorized personnel, which then leads to standards defining the exact access controls, procedures detailing how access requests are processed, and guidelines suggesting best practices for password management.