In order for a security policy to be effective within an organization, it MUST include

A.
strong statements that clearly define the problem.

B.
a list of all standards that apply to the policy.

C.
owner information and date of last revision.

D.
disciplinary measures for non compliance.