What is an information security policy and why is it essential for organizations?

• A. A formal document stating security requirements, roles, and acceptable use; essential to set expectations, guide behavior, and support compliance.
• B. A technical manual for configuring servers; essential to automate deployment.
• C. A list of all employees' phone numbers; essential to contact them.
• D. A budget spreadsheet for security projects; essential to justify spending.

Answer: (A)

An information security policy is a formal, centralized document that codifies what security must be, who is responsible for enforcing it, and what constitutes acceptable use of organizational resources. It’s essential because it establishes clear expectations for everyone, guides both everyday and technical decision-making, and provides a foundation for demonstrating compliance with laws, standards, and contracts. With defined rules and assigned responsibilities, employees understand allowed behaviors, managers can assign accountability, and the organization can consistently enforce controls and respond effectively to incidents.

Other items like a manual for configuring servers, a list of employees’ phone numbers, or a budget spreadsheet don’t set organizational rules or responsibilities for security; they serve different, more operational or administrative purposes.