A policy is best described as which of the following?

• A. A detailed procedure for implementing controls
• B. A statement of what should be done under specific circumstances
• C. A technical guideline for configuring devices
• D. A checklist of compliance items

Answer: (B)

A policy is a high-level statement that expresses management’s intent about what should be done under certain circumstances, who is responsible, and the general constraints. It sets the direction and expectations for security across the organization without prescribing exact steps or technical specifics. This broad, enduring guidance makes it applicable across changing technologies and environments, and it serves as the foundation that drives standards and procedures.

A detailed procedure describes the exact steps to implement controls, a technical guideline suggests specific configurations, and a compliance checklist is used to verify adherence. Each of those is more prescriptive or operational than a policy, which is why the statement of what should be done under specific circumstances is the best fit.