Who should be covered by an organization's information security policy?

• A. Only customers
• B. Public visitors
• C. Only vendors
• D. Employees and contractors

Answer: (D)

An information security policy is the rule set that governs how those who use and access the organization's systems must behave. The most important audience to cover are the people who have legitimate access to data and networks—employees and contractors. They interact with sensitive information, systems, and environments every day, so the policy must define acceptable use, authentication requirements, access control, incident reporting, and consequences for noncompliance. This focus helps protect data from misuse and reduces insider risk, since these individuals are the ones who could inadvertently or deliberately cause security breaches.

Customers and public visitors are external to the internal IT environment and aren’t responsible for following the organization’s day-to-day security controls in the same way. Vendors or third parties who access systems on behalf of the organization are typically managed through contractual terms and separate third-party security considerations, but the core policy is centered on internal users—employees and contractors.