Req 2.5 requires security policies for vendor defaults and other security params. What should be true about these policies?

• A. They are documented, in use, and known to all affected parties
• B. They are only in draft form
• C. They are not communicated
• D. They apply only to vendors

Answer: (A)

Policies for vendor defaults and other security parameters must be formal and actionable. When a policy is documented, it is clear what needs to be done, who is responsible, and how compliance is measured. If it’s in use, the organization actually applies the standard across systems and vendor-related settings. Knowing it is shared with all affected parties—such as security teams, administrators, procurement, and vendors—ensures everyone understands the required configuration, can verify it, and can enforce it consistently. This combination of documentation, practical implementation, and broad awareness enables reliable control over vendor defaults and related security parameters.

Draft-only policies wouldn’t enforce any standard, and undistributed policies lead to inconsistent configurations and gaps. Limiting the policy to vendors would miss internal systems and processes that also rely on vendor defaults and security parameters.