What security practice involves defining company rules, job duties, and expectations?

• A. Developing a security policy
• B. Implementing access control
• C. Performing a risk assessment
• D. Conducting a security audit

Answer: (A)

Defining company rules, job duties, and expectations is what a security policy does. A security policy is the formal document that establishes governance for security practices, outlining what is allowed and prohibited, who is responsible for protecting assets, and how employees should behave. It sets roles and responsibilities, such as who handles incident response, who approves access, how issues are reported, and what happens if rules aren’t followed. This foundation guides training, enforcement, and consistency across the organization.

Implementing access control deals with who can access what resources and under what conditions, applying technical and administrative controls. A risk assessment focuses on identifying threats and vulnerabilities and evaluating their potential impact. Conducting a security audit reviews compliance and effectiveness after controls are in place.