What is the purpose for an organization to have an information security policy?

A.
To demonstrate the operation of the Plan-Do-Check-Act cycle within an organization.

B.
To ensure that staff do not break any laws.

C.
To give direction to how information security is set up within an organization.

D.
To ensure that everyone knows who is responsible for carrying out the backup procedures.

Explanation: