Exam CSSLP topic 1 question 70 discussion

A, B, D A well-designed security policy should clearly address: - **What is being secured** (A): Identifying the assets that require protection. - **Where is the vulnerability, threat, or risk** (B): Outlining the potential security concerns that the policy aims to mitigate. - **Who is expected to comply with the policy** (D): Specifying the individuals or groups that must follow the policy guidelines. While understanding potential adversaries is crucial for security strategies, specific identification of who might exploit vulnerabilities is usually not a direct component of a general security policy.

All of the options A, B, C, and D are required to be addressed in a well-designed security policy. A. What is being secured? The policy should clearly define the assets that need to be protected and the level of protection that is required for them. B. Where is the vulnerability, threat, or risk? The policy should identify the potential vulnerabilities, threats, and risks that the organization faces and the measures that need to be taken to mitigate them. C. Who is expected to exploit the vulnerability? The policy should identify the potential threat actors who may exploit vulnerabilities in the organization's assets and systems. D. Who is expected to comply with the policy? The policy should clearly define the roles and responsibilities of both employees and management in ensuring the security of the organization's assets and information. It should also outline the consequences of non-compliance with the policy.