If an organization were to monitor their employees’ e-mail, it should not:

A.
Monitor only a limited number of employees.

B.
Inform all employees that e-mail is being monitored.

C.
Explain who can read the e-mail and how long it is backed up.

D.
Explain what is considered an acceptable use of the e-mail system.

Explanation:
All the employees should be monitored, not only a few.
Incorrect Answers:
B: If a company feels it may be necessary to monitor e-mail messages and usage, this must be explained to the
employees.
C: The company should outline who can and cannot read employee messages, describe the circumstances
under which e-mail monitoring may be acceptable, and specify where the e-mail can be accessed.
D: The company should state which e-mail activity is acceptable.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1020