Which security policy category includes backup and restore policy as an example?

Which security policy category includes backup and restore policy as an example?

• A. Enterprise Information Security Policy (EISP)
• B. Safeguard Security Requirements
• C. Procedural Security Requirements
• D. Issue Specific Security Policy (ISSP)

Answer: (D)

The main idea is that backup and restore policy focuses on a specific security issue. That makes it an Issue Specific Security Policy: a policy that addresses a particular area of security—how data is backed up, stored, protected, and restored in case of loss. It sits under the broader security program but targets one topic rather than outlining the organization’s overall security posture. An Enterprise Information Security Policy covers organization-wide goals, governance, and responsibilities, not the detailed rules for a single issue. Procedural Security Requirements describe how to implement or enforce controls, i.e., the steps teams must follow, rather than naming the policy category itself. The remaining option isn’t a standard policy category used to classify policies. So, backup and restore policy is best described as an Issue Specific Security Policy.

The main idea is that backup and restore policy focuses on a specific security issue. That makes it an Issue Specific Security Policy: a policy that addresses a particular area of security—how data is backed up, stored, protected, and restored in case of loss. It sits under the broader security program but targets one topic rather than outlining the organization’s overall security posture. An Enterprise Information Security Policy covers organization-wide goals, governance, and responsibilities, not the detailed rules for a single issue. Procedural Security Requirements describe how to implement or enforce controls, i.e., the steps teams must follow, rather than naming the policy category itself. The remaining option isn’t a standard policy category used to classify policies. So, backup and restore policy is best described as an Issue Specific Security Policy.