Which of the following is a typical element of a security policy framework?

• A. Encryption methods and password policies only.
• B. Policy statements, scope, roles and responsibilities, standards, procedures, enforcement, training, and review.
• C. Incident response and disaster recovery planning exclusively.
• D. Employee onboarding timelines.

Answer: (B)

A security policy framework is the governance backbone that directs how security is written, distributed, and maintained across an organization. The best answer lists policy statements, scope, roles and responsibilities, standards, procedures, enforcement, training, and review because this combination creates a complete, actionable, and continuously improving system. Policy statements set intent, scope defines boundaries, and roles/responsibilities assign accountability. Standards translate policies into mandatory controls, while procedures describe the exact steps to implement them. Enforcement ensures compliance, training raises awareness and competence, and ongoing review keeps the framework aligned with changing threats and business needs.

The other options are too narrow: focusing only on technical controls like encryption and passwords misses governance and how those controls fit into the broader security program. Relying exclusively on incident response and disaster recovery ignores the governance, training, and audit elements that sustain security over time. Onboarding timelines have little to do with the structure or management of security policy.