What defines a set of rules for protecting sensitive resources?

• A. Security Framework
• B. Incident Response Plan
• C. Security Policy
• D. Data Management Plan

Answer: (C)

A security policy defines a set of rules and guidelines for protecting sensitive resources within an organization. This document outlines how data and assets should be managed and secured, establishing standards for the behavior of employees and the technical measures necessary to safeguard sensitive information. By specifying rules for acceptable use, access controls, data encryption, and incident reporting, a security policy ensures that everyone in the organization understands their responsibilities regarding information security and privacy.

The other options provide different aspects of information security management but do not serve the same purpose as a security policy. A security framework is a broader structure that encompasses various security policies and practices, while an incident response plan focuses specifically on how to respond to security breaches when they occur. A data management plan, on the other hand, primarily deals with how data is created, stored, and shared, not specifically addressing the security measures needed to protect sensitive resources.