Which element comprises essential items to discuss in the security policy?

• A. Security Awareness Training
• B. Auditing Requirements and their Frequency
• C. Baselines
• D. Incident Response Plan

Answer: (B)

Auditing requirements and how often audits occur are central to security governance. A policy that specifies what will be audited, what evidence is needed, who conducts the audits, and how often they happen creates a measurable, repeatable approach to verifying that controls are in place and functioning. This clarity ensures accountability, supports regulatory compliance, and enables timely detection and response to issues. Without defined audit frequency, checks can become inconsistent, leaving gaps in security oversight. Other items like training, baselines, or incident response plans are important, but the policy needs explicit, ongoing verification mechanisms—auditing and their frequency—to drive continuous assurance.