What constitutes an effective security policy in a Protection of Assets program?

• A. An informal memo
• B. A written, approved policy that defines objectives, scope, roles, responsibilities, controls, and enforcement, with a process for review.
• C. A security manual without review
• D. A risk assessment

Answer: (B)

A solid security policy is the governance backbone of protecting assets. It is a formal, written document that is approved by leadership and clearly defines objectives, scope, roles and responsibilities, controls, and how enforcement will work, plus a defined process for periodic review and update. This combination creates authority, consistency, and accountability, ensuring the program stays aligned with business goals, legal requirements, and the evolving threat landscape. An informal memo lacks the formal authority and clear commitments needed to drive behavior and resource allocation. A security manual that isn’t reviewed can quickly become outdated and ineffective. A risk assessment is essential for identifying threats and prioritizing controls, but it isn’t the policy itself; it informs what the policy should address.