Which of the following is not true pertaining to security policies?

A.
It should not be technology oriented.

B.
It should not be solution-independent.

C.
It should not outline goals and missions.

D.
It should not be granular in nature.

Explanation:
A security policy consists of high-level statements that should be
solution-independent.