Which set of documents defines the basic security requirements and rules to protect an organization's systems?

Which set of documents defines the basic security requirements and rules to protect an organization's systems?

• A. Security Policies
• B. Information Security Policies
• C. Defense-in-Depth
• D. EISA

Answer: (A)

The main idea here is a formal set of rules that govern how security is managed across an organization. Security policies define the high‑level requirements, responsibilities, and rules that everything else in the security program builds upon—things like who may access what resources, how assets must be protected, acceptable use, and how incidents are handled. They establish the baseline that all standards, procedures, and controls are designed to meet. That’s why this option is the best answer. It represents the official documents that codify the organization’s security expectations and governance. Defense-in-depth describes a strategy of layering protective controls, not a single collection of governing documents. EISA isn't about organizational security policy definitions. Information Security Policies is closely related, but the general, umbrella term for the official rules and requirements used to protect systems is Security Policies.

The main idea here is a formal set of rules that govern how security is managed across an organization. Security policies define the high‑level requirements, responsibilities, and rules that everything else in the security program builds upon—things like who may access what resources, how assets must be protected, acceptable use, and how incidents are handled. They establish the baseline that all standards, procedures, and controls are designed to meet.

That’s why this option is the best answer. It represents the official documents that codify the organization’s security expectations and governance.

Defense-in-depth describes a strategy of layering protective controls, not a single collection of governing documents. EISA isn't about organizational security policy definitions. Information Security Policies is closely related, but the general, umbrella term for the official rules and requirements used to protect systems is Security Policies.