Used to state the role of security in an organization and establishes the desired end-state of the security program.

• A. Procedures
• B. Guidelines
• C. Standards
• D. Policies

Answer: (D)

Policies establish how security is governed in an organization and define the desired end-state the security program aims to achieve. They express management’s intent, set the overall direction, and specify binding requirements that shape decisions, actions, and controls across the organization. This high-level, authoritative nature distinguishes policies from other artifacts: procedures describe the exact steps to perform tasks; guidelines offer recommended, optional practices; standards lay out concrete, mandatory criteria derived from the policy to enforce it. When a statement emphasizes the role of security and the intended end-state, it’s guiding the program at the governance level, which is the purpose of a security policy.