(ISC)2 Certified in Cybersecurity Practice Exam

What kind of policies are mandatory and require high-level approval?

1. Proactive Policies

2. Operational Policies

3. Mandatory Policies

4. Advisory Policies

The correct answer is: Mandatory Policies

Mandatory policies are the correct choice because they are defined by an organization as essential guidelines or rules that must be followed by all employees within the company. These policies typically address compliance, security, legal requirements, and risk management, and are crucial for maintaining the integrity and security of the organization’s operations. The need for high-level approval is inherent to mandatory policies, as they often involve significant implications for the organization and require top management's endorsement to ensure that all employees are aware of and adhere to the directives. In contrast, proactive policies aim to prevent issues before they arise but may not require formal approval from upper management. Operational policies provide day-to-day guidelines for employees and may not necessarily carry the same level of authority or mandatory nature. Advisory policies generally offer guidance and recommendations rather than imposing strict requirements, thus lacking the authoritative enforcement characteristic of mandatory policies.