What is the primary purpose of an information security policy?

• A. Approved by mgmt and serves as foundation for the info security controls of an organization (includes incident mgmt and exception process)
• B. To maximize marketing reach
• C. To reduce payroll costs
• D. To manage customer complaints

Answer: (A)

An information security policy provides governance and direction for how information assets must be protected. When senior management approves it, the policy carries authority across the organization and sets the scope, objectives, and expected behavior for everyone handling information. It serves as the foundation for all security controls by outlining the overarching rules that drive standards, procedures, incident response, and how exceptions are reviewed and approved. This ensures consistency in how security is implemented, enforced, and measured, and it supports auditability and regulatory compliance. The other goals mentioned—expanding marketing reach, reducing payroll costs, or managing customer complaints—do not address information security governance or the foundation for security controls.