Who is responsible for establishing, documenting, and distributing security policies and procedures?

• A. Chief Security Officer or other security-knowledgeable management member
• B. Security vendor
• C. IT Help Desk
• D. Human Resources

Answer: (A)

Policy governance and ownership rests with senior security leadership. The Chief Security Officer or an equivalent security-knowledgeable management member is responsible for establishing the organization's security policies and procedures, ensuring they reflect regulatory requirements and risk posture, documenting them clearly, and distributing them to all relevant stakeholders. This role has the authority to set standards, coordinate across business units, and drive training and enforcement.

Security vendors may provide templates or support, but they do not own enterprise policy across the organization. The IT Help Desk implements and enforces procedures but does not originate or distribute policy at the organizational level. Human Resources handles people processes and awareness but does not establish the technical governance framework. Therefore, the responsibility lies with the Chief Security Officer or a similar security-focused leader.