Which organization policy should address information security for employees and contractors?

• A. A policy that addresses information security for customers and contractors
• B. A policy that addresses information security for employees and contractors
• C. A policy that addresses information security for vendors only
• D. A policy that addresses information security for executives

Answer: (B)

Information security policies must define who must follow them and what controls apply to anyone who handles or accesses the organization’s data. The best policy is one that explicitly covers both employees and contractors because they are the primary users who access systems and information—employees as internal users and contractors as external workers who may still have substantial access. By including both, the organization ensures consistent requirements for authentication, access control, security training, acceptable use, incident reporting, and proper offboarding when contracts end. Policies that only address customers and contractors miss internal users, while focusing on vendors or executives alone omits the broader population that interacts with data, leaving gaps in protection.