Which term refers to the set of rules governing how sensitive information is managed, protected, and distributed?

Which term refers to the set of rules governing how sensitive information is managed, protected, and distributed?

• A. Security Officer
• B. Security Policy
• C. System Development Life Cycle
• D. Schema

Answer: (B)

This item tests understanding of governance for sensitive data: the document that sets the rules for how information is managed, protected, and shared. A Security Policy defines the rules and guidelines for information security, including who may access data, what protections are required (such as encryption and authentication), how data should be classified, stored, transmitted, and retained, and who is responsible for enforcing these rules. It provides the governance foundation that informs standards, procedures, and technical controls across the organization, ensuring consistent security practices. The Security Officer is a role focused on implementing and enforcing security—not the binding rules themselves. The System Development Life Cycle outlines processes for building and maintaining systems, not the rules for handling sensitive information. A Schema describes the structure of data in a database, not how that data should be governed or protected.

This item tests understanding of governance for sensitive data: the document that sets the rules for how information is managed, protected, and shared. A Security Policy defines the rules and guidelines for information security, including who may access data, what protections are required (such as encryption and authentication), how data should be classified, stored, transmitted, and retained, and who is responsible for enforcing these rules. It provides the governance foundation that informs standards, procedures, and technical controls across the organization, ensuring consistent security practices.

The Security Officer is a role focused on implementing and enforcing security—not the binding rules themselves. The System Development Life Cycle outlines processes for building and maintaining systems, not the rules for handling sensitive information. A Schema describes the structure of data in a database, not how that data should be governed or protected.