What must be done with the information security policy to ensure it reaches relevant personnel?

• A. Published and disseminated to all relevant personnel
• B. Kept confidential within IT
• C. Only posted on the intranet
• D. Printed and filed

Answer: (A)

The policy must be communicated so everyone who needs to follow it actually knows it and can act on it. Publishing and disseminating to all relevant personnel makes the policy accessible, increases awareness, and creates accountability. If the policy stays within IT or is only posted on an intranet, not everyone who needs to follow it will see it—temporary staff, contractors, and individuals without ready intranet access can miss it. Simply printing and filing it also leaves it out of daily practice unless there’s active dissemination, training, and acknowledgement. By publishing and distributing the policy to all relevant personnel (ideally with training and a signed acknowledgment), everyone understands their responsibilities and knows where to turn for guidance.