Which policy type is explicitly designed to govern a specific security concern, such as email privacy?

• A. Issue-specific Policies
• B. Organizational Security Policies
• C. Management Control
• D. Magnitude

Answer: (A)

When you map out security policies, you’ll see that some are built to address a single issue in detail. An issue-specific policy is designed to govern a specific security concern, providing concrete rules and procedures for that area—like email privacy. It can specify who is allowed to access email, what monitoring is permissible, how data should be encrypted and stored, retention periods, incident reporting, and consequences for violations. Because it’s narrowly scoped, it’s straightforward to update as technology or regulations change, and it gives clear guidance to users and administrators on that particular topic.

Organizational security policies, by contrast, give broad principles and governance for the entire organization rather than focusing on one issue. Management control refers to the mechanisms and processes used to enforce policies and manage risk, not a distinct policy category. Magnitude isn’t a type of policy at all.