Tom has just completed the companys first-ever security policy after getting final sign-off from the executive committee. The security policy that Tom is publishing could include all of the following initiatives except:

A.
Detailed procedure on how the policy will be carried out

B.
Organizational chart that includes the security team and escalation contacts

C.
Definition of the company’s acceptable risk level

D.
Data classification plan

Explanation:
A security policy is a document that portrays senior management’s directives
pertaining to the organization’s security program. It should outline security roles
and responsibilities, data classification needs and goals, and the level of risk the
company is willing to accept. A policy does not provide detailed information or
procedures.