What is the purpose of a security policy framework in an organization?

• A. To provide a framework to ensure Info Sec policies are clear, enforceable, and agreed by management.
• B. To catalog every employee's personal data.
• C. To provide a technical manual for network devices.
• D. To define system hardware requirements.

Answer: (A)

A security policy framework provides governance and structure for information security across the organization. It defines how policies are created, approved by management, communicated, enforced, and reviewed, ensuring they are clear, consistent, and backed by leadership. This alignment with management and the ongoing governance process helps with accountability, regulatory compliance, and adapting policies as threats and business needs change. It’s not about cataloging employee data, technical manuals for devices, or hardware requirements—they’re separate artifacts. The framework focuses on the policy side and how those policies live and evolve within the organization.