ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Security policies are administrative controls that communicate management's intent and expectations. They are concise, high-level statements that describe allowed and prohibited activities, set overall direction, and assign authority. Policies do not contain the granular how-to steps found in procedures, the numeric thresholds found in standards or baselines, or constantly changing asset inventories. Therefore, focusing the Cloud Acceptable Use Policy on broad directives that define acceptable and unacceptable behavior is the correct approach, while the other options describe content better suited for supporting documents such as procedures, standards, or operational inventories.