CISSP-ISSEP: Information Systems Security Engineering Professional

A security policy is a broad, general statement issued by senior management that establishes the role of security within the organization. Which of the following must be addressed in a well-designed policy? Each correct answer represents part of the solution. Choose all that apply.