Policy Description Based on Requirement is best described as:

Policy Description Based on Requirement is best described as:

• A. It focuses on encryption and user management.
• B. This concept defines the roles, responsibilities, and functions of a security policy.
• C. It describes system hardware requirements.
• D. It outlines physical security controls.

Answer: (B)

Describing a policy based on requirements is really about governance—clearly assigning who owns the policy, who approves it, who is responsible for enforcing it, and what the policy is meant to do. That focus on roles, responsibilities, and the functions of the policy explains why this choice is the best description. It isn’t about technical controls like encryption or user management, which are specific safeguards, nor about hardware specifications or physical security measures. Those latter areas describe concrete controls or infrastructure, not how a policy is governed or implemented. So, the description that defines the roles, responsibilities, and functions of a security policy best captures what a policy description based on requirement is aiming to convey.

Describing a policy based on requirements is really about governance—clearly assigning who owns the policy, who approves it, who is responsible for enforcing it, and what the policy is meant to do. That focus on roles, responsibilities, and the functions of the policy explains why this choice is the best description. It isn’t about technical controls like encryption or user management, which are specific safeguards, nor about hardware specifications or physical security measures. Those latter areas describe concrete controls or infrastructure, not how a policy is governed or implemented. So, the description that defines the roles, responsibilities, and functions of a security policy best captures what a policy description based on requirement is aiming to convey.