Certified Incident Handler (ECIH v3) — Question 24

A security policy will take the form of a document or a collection of documents, depending on the situation or usage. It can become a point of reference in case a violation occurs that results in dismissal or other penalty. Which of the following is NOT true for a good security policy?

Answer options

• A. It must be enforceable with security tools where appropriate and with sanctions where actual prevention is not technically feasible
• B. It must be approved by court of law after verifications of the stated terms and facts
• C. It must be implemented through system administration procedures, publishing of acceptable use guide lines or other appropriate methods
• D. It must clearly define the areas of responsibilities of the users, administrators and management

Correct answer: B

Explanation

Option B is incorrect because a good security policy does not need court approval; it is typically developed and approved internally by an organization's management. The other options (A, C, D) are true as they highlight essential aspects of an effective security policy, focusing on enforceability, implementation, and clear delineation of responsibilities.