ITIL 4 Foundation Practice Exam

What does an information security policy define?

1. The technical specifications for network equipment

2. The organization’s approach to information security management

3. The criteria for IT service quality

4. The financial budget for IT departments

The correct answer is: The organization’s approach to information security management

An information security policy defines the organization’s approach to information security management. This policy serves as a foundational document that outlines principles, standards, and guidelines for safeguarding information assets against threats and vulnerabilities. It establishes the framework within which information security is managed, including roles and responsibilities, procedures for risk assessment, and measures for compliance with regulations and standards. This approach is crucial for maintaining the confidentiality, integrity, and availability of information, ensuring that the organization adequately protects its data and responds appropriately to any security incidents. In contrast, the other options pertain to different aspects of IT management. Technical specifications for network equipment focus on the hardware and software requirements rather than security governance. The criteria for IT service quality relate to the performance and reliability of IT services, while the financial budget for IT departments concerns financial planning rather than the strategic management of information security.