What must security policies and operational procedures for security monitoring and testing be?

• A. Documented, in use, and known to all affected parties
• B. Optional
• C. Only technical controls
• D. Documented but not shared

Answer: (A)

Security monitoring and testing require formal, written guidance that is actively used and shared with those responsible for or affected by it. When policies and procedures are documented, they provide a consistent approach to how monitoring, logging, alerting, testing, and validation are performed. “In use” means these guidelines aren’t just on paper—they are put into practice by the people who carry out the tasks. Making them known to all affected parties ensures everyone understands their responsibilities and how to respond to findings. This combination—documentation, active use, and broad awareness—is essential for effective governance and consistent security activities.

The other options fall short because security governance isn’t optional, it isn’t limited to technical controls alone, and keeping policies documented but not shared prevents the necessary awareness and accountability.