Which policy focuses on password hygiene necessary for protecting organizational resources?

Which policy focuses on password hygiene necessary for protecting organizational resources?

• A. Passwords Policy
• B. Email Security Policy
• C. Network-Connection Policy
• D. Acceptable-Use Policy

Answer: (A)

Focusing on how passwords are created, stored, changed, and managed directly addresses protecting organizational resources. A Password Policy formalizes these practices—setting rules for password length and complexity, requiring unique passwords, restricting reuse, defining how often passwords must be changed, and outlining how failed attempts are handled. It also often covers secure handling and storage of credentials (such as avoiding plaintext storage and encouraging or mandating multi-factor authentication). By standardizing these practices, the organization reduces the risk of credential theft, reuse across services, and improper disclosure, which are common entry points for attackers. Other policies cover related areas but not the same narrow focus. An Email Security Policy concentrates on securing email channels, phishing defenses, and email encryption, not the ongoing management of passwords across resources. A Network-Connection Policy governs how devices connect to the network and what authentication methods are allowed for access, but its primary aim is connection control rather than the broader lifecycle and hygiene of user passwords. An Acceptable-Use Policy sets allowed behaviors and duties when using resources, which may touch on password confidentiality but doesn’t prescribe the detailed, repeatable password hygiene practices needed to protect resources consistently. So the policy that best fits “password hygiene necessary for protecting organizational resources” is the Password Policy.

Focusing on how passwords are created, stored, changed, and managed directly addresses protecting organizational resources. A Password Policy formalizes these practices—setting rules for password length and complexity, requiring unique passwords, restricting reuse, defining how often passwords must be changed, and outlining how failed attempts are handled. It also often covers secure handling and storage of credentials (such as avoiding plaintext storage and encouraging or mandating multi-factor authentication). By standardizing these practices, the organization reduces the risk of credential theft, reuse across services, and improper disclosure, which are common entry points for attackers.

Other policies cover related areas but not the same narrow focus. An Email Security Policy concentrates on securing email channels, phishing defenses, and email encryption, not the ongoing management of passwords across resources. A Network-Connection Policy governs how devices connect to the network and what authentication methods are allowed for access, but its primary aim is connection control rather than the broader lifecycle and hygiene of user passwords. An Acceptable-Use Policy sets allowed behaviors and duties when using resources, which may touch on password confidentiality but doesn’t prescribe the detailed, repeatable password hygiene practices needed to protect resources consistently.

So the policy that best fits “password hygiene necessary for protecting organizational resources” is the Password Policy.