What should trigger a policy update for information security?

What should trigger a policy update for information security?

• A. Changes to business objectives or risk environment
• B. Employee vacations
• C. Vendor preference
• D. New coffee maker in break room

Answer: (A)

Policy updates for information security should be driven by changes that affect how data is protected, such as shifts in business objectives or the risk environment. When objectives evolve or the risk landscape changes, controls, ownership, and requirements may need to be revised to stay aligned with current priorities and regulatory or contractual obligations. This keeps the security posture effective as threats and business needs evolve. Items like employee vacations are routine people-management events and don’t by themselves justify changing security policy. A vendor preference affects procurement, not security policy unless it introduces new security requirements or risk considerations. A new coffee maker in the break room has no information security impact.

Policy updates for information security should be driven by changes that affect how data is protected, such as shifts in business objectives or the risk environment. When objectives evolve or the risk landscape changes, controls, ownership, and requirements may need to be revised to stay aligned with current priorities and regulatory or contractual obligations. This keeps the security posture effective as threats and business needs evolve.

Items like employee vacations are routine people-management events and don’t by themselves justify changing security policy. A vendor preference affects procurement, not security policy unless it introduces new security requirements or risk considerations. A new coffee maker in the break room has no information security impact.