What are high-level policies?

A.
They are step-by-step procedures to implement a safeguard.

B.
They are the instructions on how to perform a Quantitative Risk Analysis.

C.
They are recommendations for procedural controls.

D.
They are statements that indicate a senior management’s intention to support InfoSec.

Explanation:
The correct answer is “They are statements that indicate a senior management’s intention to
support InfoSec”. High-level policies are senior management statements of recognition of the
importance of InfoSec controls.