Which three components should be included in a security policy? (Choose three.)

A.
identification and authentication policy

B.
incident handling procedure

C.
security best practice

D.
security product recommendation

E.
software specifications

F.
statement of authority and scope