The Company security administrator is in charge of creating a security policy for the company.
Which two statements about the creation of a security policy are true?
(Choose two)

A.
It helps Chief Information Officers determine the return on investment of network security at
Company Inc.

B.
It defines how to track down and prosecute policy offenders at Company Inc.

C.
It provides a process to audit existing network security at Company Inc.

D.
It defines which behavior is and is not allowed at Company Inc.