What must be true about security policies and operational procedures for developing and maintaining secure systems and applications?

• A. They are optional and can be ignored
• B. They exist only in one department
• C. They are documented, in use, and known to all affected parties
• D. They apply only to production systems

Answer: (C)

Policies and procedures for developing and maintaining secure systems must be formally documented, actively used, and known to everyone affected. Documenting them creates a clear, approved standard that teams can follow rather than relying on memory or ad-hoc practices. When they’re in use, there are concrete processes—such as change control, secure coding guidelines, and incident response—that ensure security is actually applied throughout development and operations. Making sure all relevant people know about them ensures developers, operators, testers, managers, and security staff understand their responsibilities and how to act securely. This alignment reduces gaps and inconsistencies across the lifecycle.

If a policy is optional, it won’t guide behavior consistently. If it exists only in one department, others won’t be aware or accountable. If it applies only to production systems, essential practices during development and testing would be missed.