Security policies & operational procedures for protecting systems against malware must be...

• A. Documented
• B. In use
• C. Documented, in use, and known to all affected parties
• D. Not required

Answer: (C)

Security policies and operational procedures for protecting systems against malware must be documented, in use, and known to all affected parties. Documented means there is an official policy that is reviewed and kept up to date. In use ensures the policy is actually implemented through the organization’s anti-malware controls, processes, and day-to-day practices. Known to all affected parties means everyone who has a role—employees, contractors, and any third parties—understands their responsibilities and how to follow the procedures. Together, these elements create a formal, actionable, and enforceable framework, which is essential for consistent protection and accountability. If it’s only documented, there’s no guarantee it’s being followed; if it’s only in use, there may be no formal standard or awareness; and saying it isn’t required is incorrect.